From patchwork Wed Feb 23 16:11:32 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Hefty, Sean" X-Patchwork-Id: 585091 X-Patchwork-Delegate: alexne@voltaire.com Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by demeter1.kernel.org (8.14.4/8.14.3) with ESMTP id p1NGBauj010069 for ; Wed, 23 Feb 2011 16:11:36 GMT Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754539Ab1BWQLe (ORCPT ); Wed, 23 Feb 2011 11:11:34 -0500 Received: from mga11.intel.com ([192.55.52.93]:34065 "EHLO mga11.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754535Ab1BWQLe convert rfc822-to-8bit (ORCPT ); Wed, 23 Feb 2011 11:11:34 -0500 Received: from fmsmga001.fm.intel.com ([10.253.24.23]) by fmsmga102.fm.intel.com with ESMTP; 23 Feb 2011 08:11:34 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="4.62,212,1297065600"; d="scan'208";a="890482214" Received: from orsmsx604.amr.corp.intel.com ([10.22.226.87]) by fmsmga001.fm.intel.com with ESMTP; 23 Feb 2011 08:11:34 -0800 Received: from orsmsx501.amr.corp.intel.com ([10.22.226.209]) by orsmsx604.amr.corp.intel.com ([10.250.113.17]) with mapi; Wed, 23 Feb 2011 08:11:33 -0800 From: "Hefty, Sean" To: "linux-rdma@vger.kernel.org" , Roland Dreier CC: Doug Ledford Date: Wed, 23 Feb 2011 08:11:32 -0800 Subject: [PATCH 1/2] rdma/cm: Fix crash in request handlers Thread-Topic: [PATCH 1/2] rdma/cm: Fix crash in request handlers Thread-Index: AcvTdFYeaaQMO705R2eTRRqJqdfjwA== Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: acceptlanguage: en-US MIME-Version: 1.0 Sender: linux-rdma-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-rdma@vger.kernel.org X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.2.6 (demeter1.kernel.org [140.211.167.41]); Wed, 23 Feb 2011 16:11:36 +0000 (UTC) diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c index 6884da2..e450c5a 100644 --- a/drivers/infiniband/core/cma.c +++ b/drivers/infiniband/core/cma.c @@ -1210,6 +1210,11 @@ static int cma_req_handler(struct ib_cm_id *cm_id, struct ib_cm_event *ib_event) cm_id->context = conn_id; cm_id->cm_handler = cma_ib_handler; + /* + * Protect against the user destroying conn_id from another thread + * until we're done accessing it. + */ + atomic_inc(&conn_id->refcount); ret = conn_id->id.event_handler(&conn_id->id, &event); if (!ret) { /* @@ -1222,8 +1227,10 @@ static int cma_req_handler(struct ib_cm_id *cm_id, struct ib_cm_event *ib_event) ib_send_cm_mra(cm_id, CMA_CM_MRA_SETTING, NULL, 0); mutex_unlock(&lock); mutex_unlock(&conn_id->handler_mutex); + cma_deref_id(conn_id); goto out; } + cma_deref_id(conn_id); /* Destroy the CM ID by returning a non-zero value. */ conn_id->cm_id.ib = NULL; @@ -1425,17 +1432,25 @@ static int iw_conn_req_handler(struct iw_cm_id *cm_id, event.param.conn.private_data_len = iw_event->private_data_len; event.param.conn.initiator_depth = attr.max_qp_init_rd_atom; event.param.conn.responder_resources = attr.max_qp_rd_atom; + + /* + * Protect against the user destroying conn_id from another thread + * until we're done accessing it. + */ + atomic_inc(&conn_id->refcount); ret = conn_id->id.event_handler(&conn_id->id, &event); if (ret) { /* User wants to destroy the CM ID */ conn_id->cm_id.iw = NULL; cma_exch(conn_id, CMA_DESTROYING); mutex_unlock(&conn_id->handler_mutex); + cma_deref_id(conn_id); rdma_destroy_id(&conn_id->id); goto out; } mutex_unlock(&conn_id->handler_mutex); + cma_deref_id(conn_id); out: if (dev)