From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 32A2DC3B18B for ; Thu, 13 Feb 2020 15:43:06 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 09EAC20661 for ; Thu, 13 Feb 2020 15:43:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1581608586; bh=X/HxYEGkzOyCx1UWSmnVMY8V7OZ+LRSGbtAvaH+Zfso=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=KbtmGfXtSCWTh9+CJZwyYILeOgqM2ncNUMDi3dI1MZsMdRgu8C6814lXQr8eOqLh/ JJadHicR4WLpHdzQLIknzk2+6q9HS/kSXU6iKhVLZ/N8+bdJD3tdquBtYXeAGVA4c3 Kmq/JxwqafDrgTttMf1rnzEiKi5SXchDUzOOHqec= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2387730AbgBMPnF (ORCPT ); Thu, 13 Feb 2020 10:43:05 -0500 Received: from mail.kernel.org ([198.145.29.99]:53844 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729530AbgBMP2A (ORCPT ); Thu, 13 Feb 2020 10:28:00 -0500 Received: from localhost (unknown [104.132.1.104]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 9B39D206DB; Thu, 13 Feb 2020 15:27:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1581607679; bh=X/HxYEGkzOyCx1UWSmnVMY8V7OZ+LRSGbtAvaH+Zfso=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=n1beVZ+f0BQyJz7hTpPaTOnZTdbkozeBpxGwYMNqIzJejg8G0C5jgHiP8VU3AhsCH Tnsfo0D5YPVThX9rb771RO1upflGXYW1F3+uvdFKQw9M9/CTGnTEwYixuxMxWRnt8c 10FY+UWbQqbMwpCcwF/iALFKiPCY06DJm/KKGSKk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Parav Pandit , Leon Romanovsky , Jason Gunthorpe Subject: [PATCH 5.5 011/120] RDMA/cma: Fix unbalanced cm_id reference count during address resolve Date: Thu, 13 Feb 2020 07:20:07 -0800 Message-Id: <20200213151905.332258945@linuxfoundation.org> X-Mailer: git-send-email 2.25.0 In-Reply-To: <20200213151901.039700531@linuxfoundation.org> References: <20200213151901.039700531@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Parav Pandit commit b4fb4cc5ba83b20dae13cef116c33648e81d2f44 upstream. Below commit missed the AF_IB and loopback code flow in rdma_resolve_addr(). This leads to an unbalanced cm_id refcount in cma_work_handler() which puts the refcount which was not incremented prior to queuing the work. A call trace is observed with such code flow: BUG: unable to handle kernel NULL pointer dereference at (null) [] __mutex_lock_slowpath+0x166/0x1d0 [] mutex_lock+0x1f/0x2f [] cma_work_handler+0x25/0xa0 [] process_one_work+0x17f/0x440 [] worker_thread+0x126/0x3c0 Hence, hold the cm_id reference when scheduling the resolve work item. Fixes: 722c7b2bfead ("RDMA/{cma, core}: Avoid callback on rdma_addr_cancel()") Link: https://lore.kernel.org/r/20200126142652.104803-2-leon@kernel.org Signed-off-by: Parav Pandit Signed-off-by: Leon Romanovsky Reviewed-by: Jason Gunthorpe Signed-off-by: Jason Gunthorpe Signed-off-by: Greg Kroah-Hartman --- drivers/infiniband/core/cma.c | 2 ++ 1 file changed, 2 insertions(+) --- a/drivers/infiniband/core/cma.c +++ b/drivers/infiniband/core/cma.c @@ -3118,6 +3118,7 @@ static int cma_resolve_loopback(struct r rdma_addr_get_sgid(&id_priv->id.route.addr.dev_addr, &gid); rdma_addr_set_dgid(&id_priv->id.route.addr.dev_addr, &gid); + atomic_inc(&id_priv->refcount); cma_init_resolve_addr_work(work, id_priv); queue_work(cma_wq, &work->work); return 0; @@ -3144,6 +3145,7 @@ static int cma_resolve_ib_addr(struct rd rdma_addr_set_dgid(&id_priv->id.route.addr.dev_addr, (union ib_gid *) &(((struct sockaddr_ib *) &id_priv->id.route.addr.dst_addr)->sib_addr)); + atomic_inc(&id_priv->refcount); cma_init_resolve_addr_work(work, id_priv); queue_work(cma_wq, &work->work); return 0;