RDMA/core: Fix race between destroy and release FD object
commit5.4-rM2-2.2.x-imx-squashedf0abc761bb
upstream. The call to ->lookup_put() was too early and it caused an unlock of the read/write protection of the uobject after the FD was put. This allows a race: CPU1 CPU2 rdma_lookup_put_uobject() lookup_put_fd_uobject() fput() fput() uverbs_uobject_fd_release() WARN_ON(uverbs_try_lock_object(uobj, UVERBS_LOOKUP_WRITE)); atomic_dec(usecnt) Fix the code by changing the order, first unlock and call to ->lookup_put() after that. Fixes:3832125624
("IB/core: Add support for idr types") Link: https://lore.kernel.org/r/20200423060122.6182-1-leon@kernel.org Suggested-by: Jason Gunthorpe <jgg@mellanox.com> Signed-off-by: Leon Romanovsky <leonro@mellanox.com> Signed-off-by: Jason Gunthorpe <jgg@mellanox.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
parent
1e12524f09
commit
169b8b6271
|
@ -689,7 +689,6 @@ void rdma_lookup_put_uobject(struct ib_uobject *uobj,
|
|||
enum rdma_lookup_mode mode)
|
||||
{
|
||||
assert_uverbs_usecnt(uobj, mode);
|
||||
uobj->uapi_object->type_class->lookup_put(uobj, mode);
|
||||
/*
|
||||
* In order to unlock an object, either decrease its usecnt for
|
||||
* read access or zero it in case of exclusive access. See
|
||||
|
@ -706,6 +705,7 @@ void rdma_lookup_put_uobject(struct ib_uobject *uobj,
|
|||
break;
|
||||
}
|
||||
|
||||
uobj->uapi_object->type_class->lookup_put(uobj, mode);
|
||||
/* Pairs with the kref obtained by type->lookup_get */
|
||||
uverbs_uobject_put(uobj);
|
||||
}
|
||||
|
|
Loading…
Reference in New Issue