From: Leon Romanovsky <leon@kernel.org>
To: Doug Ledford <dledford@redhat.com>, Jason Gunthorpe <jgg@mellanox.com>
Cc: Leon Romanovsky <leonro@mellanox.com>,
RDMA mailing list <linux-rdma@vger.kernel.org>,
Parav Pandit <parav@mellanox.com>
Subject: [PATCH rdma-next 1/7] RDMA/cma: Fix unbalanced cm_id reference count during address resolve
Date: Sun, 26 Jan 2020 16:26:46 +0200 [thread overview]
Message-ID: <20200126142652.104803-2-leon@kernel.org> (raw)
In-Reply-To: <20200126142652.104803-1-leon@kernel.org>
From: Parav Pandit <parav@mellanox.com>
Below cited commit missed to consider AF_IB and loopback code flow in
rdma_resolve_addr().
This leads to unbalanced cm_id refcount in cma_work_handler() which
puts the refcount which was not incremented in rdma_resolve_addr().
A call trace is observed with such code flow.
BUG: unable to handle kernel NULL pointer dereference at (null)
[<ffffffff96b67e16>] __mutex_lock_slowpath+0x166/0x1d0
[<ffffffff96b6715f>] mutex_lock+0x1f/0x2f
[<ffffffffc0beabb5>] cma_work_handler+0x25/0xa0
[<ffffffff964b9ebf>] process_one_work+0x17f/0x440
[<ffffffff964baf56>] worker_thread+0x126/0x3c0
Hence, hold the cm_id reference when scheduling resolve work item.
Fixes: 722c7b2bfead ("RDMA/{cma, core}: Avoid callback on rdma_addr_cancel()")
Signed-off-by: Parav Pandit <parav@mellanox.com>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
---
drivers/infiniband/core/cma.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index 55a9afacfedd..72f032160c4b 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -3148,6 +3148,7 @@ static int cma_resolve_loopback(struct rdma_id_private *id_priv)
rdma_addr_get_sgid(&id_priv->id.route.addr.dev_addr, &gid);
rdma_addr_set_dgid(&id_priv->id.route.addr.dev_addr, &gid);
+ atomic_inc(&id_priv->refcount);
cma_init_resolve_addr_work(work, id_priv);
queue_work(cma_wq, &work->work);
return 0;
@@ -3174,6 +3175,7 @@ static int cma_resolve_ib_addr(struct rdma_id_private *id_priv)
rdma_addr_set_dgid(&id_priv->id.route.addr.dev_addr, (union ib_gid *)
&(((struct sockaddr_ib *) &id_priv->id.route.addr.dst_addr)->sib_addr));
+ atomic_inc(&id_priv->refcount);
cma_init_resolve_addr_work(work, id_priv);
queue_work(cma_wq, &work->work);
return 0;
--
2.24.1
next prev parent reply other threads:[~2020-01-26 14:27 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-01-26 14:26 [PATCH rdma-next 0/7] CMA fix and small improvements Leon Romanovsky
2020-01-26 14:26 ` Leon Romanovsky [this message]
2020-01-28 18:25 ` [PATCH rdma-next 1/7] RDMA/cma: Fix unbalanced cm_id reference count during address resolve Jason Gunthorpe
2020-01-26 14:26 ` [PATCH rdma-next 2/7] RDMA/cma: Use helper function to enqueue resolve work item Leon Romanovsky
2020-01-26 14:26 ` [PATCH rdma-next 3/7] RDMA/cma: Use RDMA device port iterator Leon Romanovsky
2020-01-26 14:26 ` [PATCH rdma-next 4/7] RDMA/cma: Rename cma_device ref/deref helpers to to get/put Leon Romanovsky
2020-01-26 14:26 ` [PATCH rdma-next 5/7] RDMA/cma: Use refcount API to reflect refcount Leon Romanovsky
2020-01-26 14:26 ` [PATCH rdma-next 6/7] RDMA/cma: Rename cma_device ref/deref helpers to to get/put Leon Romanovsky
2020-01-26 14:26 ` [PATCH rdma-next 7/7] RDMA/cma: Use refcount API to reflect refcount Leon Romanovsky
2020-02-11 18:01 ` [PATCH rdma-next 0/7] CMA fix and small improvements Jason Gunthorpe
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200126142652.104803-2-leon@kernel.org \
--to=leon@kernel.org \
--cc=dledford@redhat.com \
--cc=jgg@mellanox.com \
--cc=leonro@mellanox.com \
--cc=linux-rdma@vger.kernel.org \
--cc=parav@mellanox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.