From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Leon Romanovsky <leonro@mellanox.com>,
Jason Gunthorpe <jgg@mellanox.com>,
Sasha Levin <sashal@kernel.org>,
linux-rdma@vger.kernel.org
Subject: [PATCH AUTOSEL 5.4 17/35] RDMA/core: Fix race between destroy and release FD object
Date: Thu, 7 May 2020 10:28:11 -0400 [thread overview]
Message-ID: <20200507142830.26239-17-sashal@kernel.org> (raw)
In-Reply-To: <20200507142830.26239-1-sashal@kernel.org>
From: Leon Romanovsky <leonro@mellanox.com>
[ Upstream commit f0abc761bbb9418876cc4d1ebc473e4ea6352e42 ]
The call to ->lookup_put() was too early and it caused an unlock of the
read/write protection of the uobject after the FD was put. This allows a
race:
CPU1 CPU2
rdma_lookup_put_uobject()
lookup_put_fd_uobject()
fput()
fput()
uverbs_uobject_fd_release()
WARN_ON(uverbs_try_lock_object(uobj,
UVERBS_LOOKUP_WRITE));
atomic_dec(usecnt)
Fix the code by changing the order, first unlock and call to
->lookup_put() after that.
Fixes: 3832125624b7 ("IB/core: Add support for idr types")
Link: https://lore.kernel.org/r/20200423060122.6182-1-leon@kernel.org
Suggested-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/core/rdma_core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/infiniband/core/rdma_core.c b/drivers/infiniband/core/rdma_core.c
index 8e650e5efb51d..1c95fefa1f06e 100644
--- a/drivers/infiniband/core/rdma_core.c
+++ b/drivers/infiniband/core/rdma_core.c
@@ -689,7 +689,6 @@ void rdma_lookup_put_uobject(struct ib_uobject *uobj,
enum rdma_lookup_mode mode)
{
assert_uverbs_usecnt(uobj, mode);
- uobj->uapi_object->type_class->lookup_put(uobj, mode);
/*
* In order to unlock an object, either decrease its usecnt for
* read access or zero it in case of exclusive access. See
@@ -706,6 +705,7 @@ void rdma_lookup_put_uobject(struct ib_uobject *uobj,
break;
}
+ uobj->uapi_object->type_class->lookup_put(uobj, mode);
/* Pairs with the kref obtained by type->lookup_get */
uverbs_uobject_put(uobj);
}
--
2.20.1
next prev parent reply other threads:[~2020-05-07 14:29 UTC|newest]
Thread overview: 37+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-05-07 14:27 [PATCH AUTOSEL 5.4 01/35] RDMA/mlx4: Initialize ib_spec on the stack Sasha Levin
2020-05-07 14:27 ` [PATCH AUTOSEL 5.4 02/35] RDMA/siw: Fix potential siw_mem refcnt leak in siw_fastreg_mr() Sasha Levin
2020-05-07 14:27 ` [PATCH AUTOSEL 5.4 03/35] nfs: Fix potential posix_acl refcnt leak in nfs3_set_acl Sasha Levin
2020-05-07 14:27 ` [PATCH AUTOSEL 5.4 04/35] vfio: avoid possible overflow in vfio_iommu_type1_pin_pages Sasha Levin
2020-05-07 14:27 ` [PATCH AUTOSEL 5.4 05/35] riscv: fix vdso build with lld Sasha Levin
2020-05-07 14:28 ` [PATCH AUTOSEL 5.4 06/35] scsi: qla2xxx: set UNLOADING before waiting for session deletion Sasha Levin
2020-05-07 14:28 ` [PATCH AUTOSEL 5.4 07/35] scsi: qla2xxx: check UNLOADING before posting async work Sasha Levin
2020-05-07 14:28 ` [PATCH AUTOSEL 5.4 08/35] scsi: target/iblock: fix WRITE SAME zeroing Sasha Levin
2020-05-07 14:28 ` [PATCH AUTOSEL 5.4 09/35] RDMA/mlx5: Set GRH fields in query QP on RoCE Sasha Levin
2020-05-07 14:28 ` [PATCH AUTOSEL 5.4 10/35] RDMA/core: Prevent mixed use of FDs between shared ufiles Sasha Levin
2020-05-07 14:28 ` [PATCH AUTOSEL 5.4 11/35] dmaengine: pch_dma.c: Avoid data race between probe and irq handler Sasha Levin
2020-05-07 14:28 ` [PATCH AUTOSEL 5.4 12/35] dmaengine: mmp_tdma: Do not ignore slave config validation errors Sasha Levin
2020-05-07 14:28 ` [PATCH AUTOSEL 5.4 13/35] dmaengine: mmp_tdma: Reset channel error on release Sasha Levin
2020-05-07 14:28 ` [PATCH AUTOSEL 5.4 14/35] vfio/type1: Fix VA->PA translation for PFNMAP VMAs in vaddr_get_pfn() Sasha Levin
2020-05-07 14:28 ` [PATCH AUTOSEL 5.4 15/35] ALSA: hda: Match both PCI ID and SSID for driver blacklist Sasha Levin
2020-05-07 14:28 ` [PATCH AUTOSEL 5.4 16/35] selftests/ftrace: Check the first record for kprobe_args_type.tc Sasha Levin
2020-05-07 14:28 ` Sasha Levin [this message]
2020-05-07 14:28 ` [PATCH AUTOSEL 5.4 18/35] cpufreq: intel_pstate: Only mention the BIOS disabling turbo mode once Sasha Levin
2020-05-07 14:28 ` [PATCH AUTOSEL 5.4 19/35] dma-buf: Fix SET_NAME ioctl uapi Sasha Levin
2020-05-07 14:28 ` [PATCH AUTOSEL 5.4 20/35] nvme: prevent double free in nvme_alloc_ns() error handling Sasha Levin
2020-05-07 14:28 ` [PATCH AUTOSEL 5.4 21/35] dmaengine: dmatest: Fix iteration non-stop logic Sasha Levin
2020-05-07 14:28 ` [PATCH AUTOSEL 5.4 22/35] i2c: iproc: generate stop event for slave writes Sasha Levin
2020-05-07 14:28 ` [PATCH AUTOSEL 5.4 23/35] ALSA: hda/hdmi: fix race in monitor detection during probe Sasha Levin
2020-05-07 14:28 ` [PATCH AUTOSEL 5.4 24/35] dmaengine: dmatest: Fix process hang when reading 'wait' parameter Sasha Levin
2020-05-07 14:28 ` [PATCH AUTOSEL 5.4 25/35] drm/amd/powerplay: avoid using pm_en before it is initialized revised Sasha Levin
2020-05-07 14:28 ` [PATCH AUTOSEL 5.4 26/35] SUNRPC: defer slow parts of rpc_free_client() to a workqueue Sasha Levin
2020-05-07 21:18 ` NeilBrown
2020-05-16 23:10 ` Sasha Levin
2020-05-07 14:28 ` [PATCH AUTOSEL 5.4 27/35] drm/amd/display: check if REFCLK_CNTL register is present Sasha Levin
2020-05-07 14:28 ` [PATCH AUTOSEL 5.4 28/35] drm/amd/display: Update downspread percent to match spreadsheet for DCN2.1 Sasha Levin
2020-05-07 14:28 ` [PATCH AUTOSEL 5.4 29/35] Fix use after free in get_tree_bdev() Sasha Levin
2020-05-07 14:28 ` [PATCH AUTOSEL 5.4 30/35] drm/qxl: lost qxl_bo_kunmap_atomic_page in qxl_image_init_helper() Sasha Levin
2020-05-07 14:28 ` [PATCH AUTOSEL 5.4 31/35] ALSA: opti9xx: shut up gcc-10 range warning Sasha Levin
2020-05-07 14:28 ` [PATCH AUTOSEL 5.4 32/35] i2c: aspeed: Avoid i2c interrupt status clear race condition Sasha Levin
2020-05-07 14:28 ` [PATCH AUTOSEL 5.4 33/35] arm64: vdso: Add -fasynchronous-unwind-tables to cflags Sasha Levin
2020-05-07 14:28 ` [PATCH AUTOSEL 5.4 34/35] iommu/amd: Fix legacy interrupt remapping for x2APIC-enabled system Sasha Levin
2020-05-07 14:28 ` [PATCH AUTOSEL 5.4 35/35] iommu/qcom: Fix local_base status check Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200507142830.26239-17-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=jgg@mellanox.com \
--cc=leonro@mellanox.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-rdma@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).