Jason Gunthorpe c3e39fa0aa RDMA/cm: Remove a race freeing timewait_info ... [ Upstream commit bede86a39d ] When creating a cm_id during REQ the id immediately becomes visible to the other MAD handlers, and shortly after the state is moved to IB_CM_REQ_RCVD This allows cm_rej_handler() to run concurrently and free the work: CPU 0 CPU1 cm_req_handler() ib_create_cm_id() cm_match_req() id_priv->state = IB_CM_REQ_RCVD cm_rej_handler() cm_acquire_id() spin_lock(&id_priv->lock) switch (id_priv->state) case IB_CM_REQ_RCVD: cm_reset_to_idle() kfree(id_priv->timewait_info); goto destroy destroy: kfree(id_priv->timewait_info); id_priv->timewait_info = NULL Causing a double free or worse. Do not free the timewait_info without also holding the id_priv->lock. Simplify this entire flow by making the free unconditional during cm_destroy_id() and removing the confusing special case error unwind during creation of the timewait_info. This also fixes a leak of the timewait if cm_destroy_id() is called in IB_CM_ESTABLISHED with an XRC TGT QP. The state machine will be left in ESTABLISHED while it needed to transition through IB_CM_TIMEWAIT to release the timewait pointer. Also fix a leak of the timewait_info if the caller mis-uses the API and does ib_send_cm_reqs(). Fixes: a977049dac ("[PATCH] IB: Add the kernel CM implementation") Link: https://lore.kernel.org/r/20200310092545.251365-4-leon@kernel.org Signed-off-by: Leon Romanovsky <leonro@mellanox.com> Signed-off-by: Jason Gunthorpe <jgg@mellanox.com> Signed-off-by: Sasha Levin <sashal@kernel.org>		2020-10-01 13:17:43 +02:00
..
core	RDMA/cm: Remove a race freeing timewait_info	2020-10-01 13:17:43 +02:00
hw	RDMA/iw_cgxb4: Fix an error handling path in 'c4iw_connect()'	2020-10-01 13:17:19 +02:00
sw	RDMA/rxe: Fix configuration of atomic queue pair attributes	2020-10-01 13:17:34 +02:00
ulp	IB/isert: Fix unaligned immediate-data handling	2020-09-17 13:47:44 +02:00
Kconfig	RDMA/odp: Use the common interval tree library instead of generic	2019-08-21 13:34:09 -03:00
Makefile	treewide: Add SPDX license identifier - Makefile/Kconfig	2019-05-21 10:50:46 +02:00