From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Yishai Hadas <yishaih@mellanox.com>,
Leon Romanovsky <leonro@mellanox.com>,
Jason Gunthorpe <jgg@mellanox.com>
Subject: [PATCH 4.20 60/80] IB/uverbs: Fix OOPs upon device disassociation
Date: Mon, 4 Feb 2019 11:37:20 +0100 [thread overview]
Message-ID: <20190204103628.543526104@linuxfoundation.org> (raw)
In-Reply-To: <20190204103620.287366543@linuxfoundation.org>
4.20-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yishai Hadas <yishaih@mellanox.com>
commit 425784aa5b029eeb80498c73a68f62c3ad1d3b3f upstream.
The async_file might be freed before the disassociation has been ended,
causing qp shutdown to use after free on it.
Since uverbs_destroy_ufile_hw is not a fence, it returns if a
disassociation is ongoing in another thread. It has to be written this way
to avoid deadlock. However this means that the ufile FD close cannot
destroy anything that may still be used by an active kref, such as the the
async_file.
To fix that move the kref_put() to be in ib_uverbs_release_file().
BUG: unable to handle kernel paging request at ffffffffba682787
PGD bc80e067 P4D bc80e067 PUD bc80f063 PMD 1313df163 PTE 80000000bc682061
Oops: 0003 [#1] SMP PTI
CPU: 1 PID: 32410 Comm: bash Tainted: G OE 4.20.0-rc6+ #3
Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
RIP: 0010:__pv_queued_spin_lock_slowpath+0x1b3/0x2a0
Code: 98 83 e2 60 49 89 df 48 8b 04 c5 80 18 72 ba 48 8d
ba 80 32 02 00 ba 00 80 00 00 4c 8d 65 14 41 bd 01 00 00 00 48 01 c7 85
d2 <48> 89 2f 48 89 fb 74 14 8b 45 08 85 c0 75 42 84 d2 74 6b f3 90 83
RSP: 0018:ffffc1bbc064fb58 EFLAGS: 00010006
RAX: ffffffffba65f4e7 RBX: ffff9f209c656c00 RCX: 0000000000000001
RDX: 0000000000008000 RSI: 0000000000000000 RDI: ffffffffba682787
RBP: ffff9f217bb23280 R08: 0000000000000001 R09: 0000000000000000
R10: ffff9f209d2c7800 R11: ffffffffffffffe8 R12: ffff9f217bb23294
R13: 0000000000000001 R14: 0000000000000000 R15: ffff9f209c656c00
FS: 00007fac55aad740(0000) GS:ffff9f217bb00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffba682787 CR3: 000000012f8e0000 CR4: 00000000000006e0
Call Trace:
_raw_spin_lock_irq+0x27/0x30
ib_uverbs_release_uevent+0x1e/0xa0 [ib_uverbs]
uverbs_free_qp+0x7e/0x90 [ib_uverbs]
destroy_hw_idr_uobject+0x1c/0x50 [ib_uverbs]
uverbs_destroy_uobject+0x2e/0x180 [ib_uverbs]
__uverbs_cleanup_ufile+0x73/0x90 [ib_uverbs]
uverbs_destroy_ufile_hw+0x5d/0x120 [ib_uverbs]
ib_uverbs_remove_one+0xea/0x240 [ib_uverbs]
ib_unregister_device+0xfb/0x200 [ib_core]
mlx5_ib_remove+0x51/0xe0 [mlx5_ib]
mlx5_remove_device+0xc1/0xd0 [mlx5_core]
mlx5_unregister_device+0x3d/0xb0 [mlx5_core]
remove_one+0x2a/0x90 [mlx5_core]
pci_device_remove+0x3b/0xc0
device_release_driver_internal+0x16d/0x240
unbind_store+0xb2/0x100
kernfs_fop_write+0x102/0x180
__vfs_write+0x36/0x1a0
? __alloc_fd+0xa9/0x170
? set_close_on_exec+0x49/0x70
vfs_write+0xad/0x1a0
ksys_write+0x52/0xc0
do_syscall_64+0x5b/0x180
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7fac551aac60
Cc: <stable@vger.kernel.org> # 4.2
Fixes: 036b10635739 ("IB/uverbs: Enable device removal when there are active user space applications")
Signed-off-by: Yishai Hadas <yishaih@mellanox.com>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/core/uverbs_main.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -262,6 +262,9 @@ void ib_uverbs_release_file(struct kref
if (atomic_dec_and_test(&file->device->refcount))
ib_uverbs_comp_dev(file->device);
+ if (file->async_file)
+ kref_put(&file->async_file->ref,
+ ib_uverbs_release_async_event_file);
put_device(&file->device->dev);
kfree(file);
}
@@ -1132,10 +1135,6 @@ static int ib_uverbs_close(struct inode
list_del_init(&file->list);
mutex_unlock(&file->device->lists_mutex);
- if (file->async_file)
- kref_put(&file->async_file->ref,
- ib_uverbs_release_async_event_file);
-
kref_put(&file->ref, ib_uverbs_release_file);
return 0;
next prev parent reply other threads:[~2019-02-04 10:56 UTC|newest]
Thread overview: 84+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-02-04 10:36 [PATCH 4.20 00/80] 4.20.7-stable review Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 01/80] drm/msm/gpu: fix building without debugfs Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 02/80] ipv6: sr: clear IP6CB(skb) on SRH ip4ip6 encapsulation Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 03/80] ipvlan, l3mdev: fix broken l3s mode wrt local routes Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 04/80] l2tp: copy 4 more bytes to linear part if necessary Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 05/80] l2tp: fix reading optional fields of L2TPv3 Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 06/80] net: ip_gre: always reports o_key to userspace Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 07/80] net: ip_gre: use erspan key field for tunnel lookup Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 08/80] net/ipv6: dont return positive numbers when nothing was dumped Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 09/80] net/mlx4_core: Add masking for a few queries on HCA caps Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 10/80] netrom: switch to sock timer API Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 11/80] net/rose: fix NULL ax25_cb kernel panic Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 12/80] net: set default network namespace in init_dummy_netdev() Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 13/80] ravb: expand rx descriptor data to accommodate hw checksum Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 14/80] sctp: improve the events for sctp stream reset Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 15/80] tun: move the call to tun_set_real_num_queues Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 16/80] ucc_geth: Reset BQL queue when stopping device Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 17/80] vhost: fix OOB in get_rx_bufs() Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 18/80] net: ip6_gre: always reports o_key to userspace Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 19/80] sctp: improve the events for sctp stream adding Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 20/80] net/mlx5e: Allow MAC invalidation while spoofchk is ON Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 21/80] ip6mr: Fix notifiers call on mroute_clean_tables() Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 22/80] Revert "net/mlx5e: E-Switch, Initialize eswitch only if eswitch manager" Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 23/80] sctp: set chunk transport correctly when its a new asoc Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 24/80] sctp: set flow sport from saddr only when its 0 Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 25/80] net: tls: Fix deadlock in free_resources tx Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 26/80] net: tls: Save iv in tls_rec for async crypto requests Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 27/80] virtio_net: Dont enable NAPI when interface is down Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 28/80] virtio_net: Dont call free_old_xmit_skbs for xdp_frames Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 29/80] virtio_net: Fix not restoring real_num_rx_queues Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 30/80] virtio_net: Fix out of bounds access of sq Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 31/80] virtio_net: Dont process redirected XDP frames when XDP is disabled Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 32/80] virtio_net: Use xdp_return_frame to free xdp_frames on destroying vqs Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 33/80] virtio_net: Differentiate sk_buff and xdp_frame on freeing Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 34/80] ipv6: Consider sk_bound_dev_if when binding a socket to an address Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 35/80] CIFS: Do not count -ENODATA as failure for query directory Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 36/80] CIFS: Fix possible oops and memory leaks in async IO Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 37/80] CIFS: Fix trace command logging for SMB2 reads and writes Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 38/80] CIFS: fix use-after-free of the lease keys Greg Kroah-Hartman
2019-02-04 10:36 ` [PATCH 4.20 39/80] CIFS: Do not consider -ENODATA as stat failure for reads Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 40/80] fs/dcache: Fix incorrect nr_dentry_unused accounting in shrink_dcache_sb() Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 41/80] iommu/vt-d: Fix memory leak in intel_iommu_put_resv_regions() Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 42/80] selftests/seccomp: Enhance per-arch ptrace syscall skip tests Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 43/80] NFS: Fix up return value on fatal errors in nfs_page_async_flush() Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 44/80] ARM: cns3xxx: Fix writing to wrong PCI config registers after alignment Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 45/80] arm64: kaslr: ensure randomized quantities are clean also when kaslr is off Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 46/80] arm64: Do not issue IPIs for user executable ptes Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 47/80] arm64: hyp-stub: Forbid kprobing of the hyp-stub Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 48/80] arm64: hibernate: Clean the __hyp_text to PoC after resume Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 49/80] gpio: altera-a10sr: Set proper output level for direction_output Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 50/80] gpiolib: fix line event timestamps for nested irqs Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 51/80] gpio: pcf857x: Fix interrupts on multiple instances Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 52/80] gpio: sprd: Fix the incorrect data register Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 53/80] gpio: sprd: Fix incorrect irq type setting for the async EIC Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 54/80] gfs2: Revert "Fix loop in gfs2_rbm_find" Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 55/80] mmc: bcm2835: Fix DMA channel leak on probe error Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 56/80] mmc: mediatek: fix incorrect register setting of hs400_cmd_int_delay Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 57/80] ALSA: usb-audio: Add Opus #3 to quirks for native DSD support Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 58/80] ALSA: hda/realtek - Fixed hp_pin no value Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 59/80] ALSA: pcm: Fix tight loop of OSS capture stream Greg Kroah-Hartman
2019-02-04 10:37 ` Greg Kroah-Hartman [this message]
2019-02-04 10:37 ` [PATCH 4.20 61/80] IB/uverbs: Fix OOPs in uverbs_user_mmap_disassociate Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 62/80] IB/hfi1: Remove overly conservative VM_EXEC flag check Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 63/80] IB/hfi1: Add limit test for RC/UC send via loopback Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 64/80] platform/x86: asus-nb-wmi: Map 0x35 to KEY_SCREENLOCK Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 65/80] platform/x86: asus-nb-wmi: Drop mapping of 0x33 and 0x34 scan codes Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 66/80] Btrfs: fix deadlock when allocating tree block during leaf/node split Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 67/80] btrfs: On error always free subvol_name in btrfs_mount Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 68/80] kernel/exit.c: release ptraced tasks before zap_pid_ns_processes Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 69/80] mm/hugetlb.c: teach follow_hugetlb_page() to handle FOLL_NOWAIT Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 70/80] oom, oom_reaper: do not enqueue same task twice Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 71/80] mm,memory_hotplug: fix scan_movable_pages() for gigantic hugepages Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 72/80] mm, oom: fix use-after-free in oom_kill_process Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 73/80] mm: hwpoison: use do_send_sig_info() instead of force_sig() Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 74/80] mm: migrate: dont rely on __PageMovable() of newpage after unlocking it Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 75/80] of: overlay: add tests to validate kfrees from overlay removal Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 76/80] of: overlay: add missing of_node_get() in __of_attach_node_sysfs Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 77/80] of: overlay: use prop add changeset entry for property in new nodes Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 78/80] of: overlay: do not duplicate properties from overlay for " Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 79/80] md/raid5: fix out of memory during raid cache recovery Greg Kroah-Hartman
2019-02-04 10:37 ` [PATCH 4.20 80/80] cifs: Always resolve hostname before reconnecting Greg Kroah-Hartman
2019-02-04 21:49 ` [PATCH 4.20 00/80] 4.20.7-stable review Guenter Roeck
2019-02-05 6:20 ` Naresh Kamboju
2019-02-05 14:43 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190204103628.543526104@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=jgg@mellanox.com \
--cc=leonro@mellanox.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=yishaih@mellanox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).