| Message ID | 2a9916bda4eb2ec63fcbf8b01041723383c3f844.1620343860.git.metze@samba.org (mailing list archive) |
|---|---|
| State | Changes Requested |
| Headers | show |
| Series | rdma/siw: fix a lot of deadlocks and use after free bugs | expand |
-----"Stefan Metzmacher" <metze@samba.org> wrote: ----- >To: "Bernard Metzler" <bmt@zurich.ibm.com> >From: "Stefan Metzmacher" <metze@samba.org> >Date: 05/07/2021 01:40AM >Cc: linux-rdma@vger.kernel.org, "Stefan Metzmacher" <metze@samba.org> >Subject: [EXTERNAL] [PATCH 27/31] rdma/siw: fix the "close" logic in >siw_qp_cm_drop() > >cep->cm_id->rem_ref(cep->cm_id) is no reason to call >siw_cep_put(cep), we never call siw_cep_get(cep) when >calling id->add_ref(id). > >But the cep->qp cleanup needs to drop both references! > >Fixes: 6c52fdc244b5 ("rdma/siw: connection management") >Signed-off-by: Stefan Metzmacher <metze@samba.org> >Cc: Bernard Metzler <bmt@zurich.ibm.com> >Cc: linux-rdma@vger.kernel.org >--- > drivers/infiniband/sw/siw/siw_cm.c | 6 ++++-- > 1 file changed, 4 insertions(+), 2 deletions(-) > >diff --git a/drivers/infiniband/sw/siw/siw_cm.c >b/drivers/infiniband/sw/siw/siw_cm.c >index 3dc80c21ac60..9f9750237e75 100644 >--- a/drivers/infiniband/sw/siw/siw_cm.c >+++ b/drivers/infiniband/sw/siw/siw_cm.c >@@ -546,7 +546,6 @@ void siw_qp_cm_drop(struct siw_qp *qp, int >schedule) > if (cep->cm_id) { > cep->cm_id->rem_ref(cep->cm_id); > cep->cm_id = NULL; >- siw_cep_put(cep); > } > cep->state = SIW_EPSTATE_CLOSED; > >@@ -559,8 +558,11 @@ void siw_qp_cm_drop(struct siw_qp *qp, int >schedule) > cep->sock = NULL; > } > if (cep->qp) { >+ BUG_ON(cep->qp->cep != cep); Please no BUG() and friends >+ cep->qp->cep = NULL; That pointer should be handled by the qp code >+ siw_qp_put(cep->qp); > cep->qp = NULL; >- siw_qp_put(qp); >+ siw_cep_put(cep); > } > out: > siw_cep_set_free(cep); >-- >2.25.1 > >
diff --git a/drivers/infiniband/sw/siw/siw_cm.c b/drivers/infiniband/sw/siw/siw_cm.c index 3dc80c21ac60..9f9750237e75 100644 --- a/drivers/infiniband/sw/siw/siw_cm.c +++ b/drivers/infiniband/sw/siw/siw_cm.c @@ -546,7 +546,6 @@ void siw_qp_cm_drop(struct siw_qp *qp, int schedule) if (cep->cm_id) { cep->cm_id->rem_ref(cep->cm_id); cep->cm_id = NULL; - siw_cep_put(cep); } cep->state = SIW_EPSTATE_CLOSED; @@ -559,8 +558,11 @@ void siw_qp_cm_drop(struct siw_qp *qp, int schedule) cep->sock = NULL; } if (cep->qp) { + BUG_ON(cep->qp->cep != cep); + cep->qp->cep = NULL; + siw_qp_put(cep->qp); cep->qp = NULL; - siw_qp_put(qp); + siw_cep_put(cep); } out: siw_cep_set_free(cep);
cep->cm_id->rem_ref(cep->cm_id) is no reason to call siw_cep_put(cep), we never call siw_cep_get(cep) when calling id->add_ref(id). But the cep->qp cleanup needs to drop both references! Fixes: 6c52fdc244b5 ("rdma/siw: connection management") Signed-off-by: Stefan Metzmacher <metze@samba.org> Cc: Bernard Metzler <bmt@zurich.ibm.com> Cc: linux-rdma@vger.kernel.org --- drivers/infiniband/sw/siw/siw_cm.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)