Jason Gunthorpe 9137108cc3 RDMA/rdma_cm: Fix use after free race with process_one_req ... process_one_req() can race with rdma_addr_cancel(): CPU0 CPU1 ==== ==== process_one_work() debug_work_deactivate(work); process_one_req() rdma_addr_cancel() mutex_lock(&lock); set_timeout(&req->work,..); __queue_work() debug_work_activate(work); mutex_unlock(&lock); mutex_lock(&lock); [..] list_del(&req->list); mutex_unlock(&lock); [..] // ODEBUG explodes since the work is still queued. kfree(req); Causing ODEBUG to detect the use after free: ODEBUG: free active (active state 0) object type: work_struct hint: process_one_req+0x0/0x6c0 include/net/dst.h:165 WARNING: CPU: 0 PID: 79 at lib/debugobjects.c:291 debug_print_object+0x166/0x220 lib/debugobjects.c:288 kvm: emulating exchange as write Kernel panic - not syncing: panic_on_warn set ... CPU: 0 PID: 79 Comm: kworker/u4:3 Not tainted 4.16.0-rc6+ #361 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: ib_addr process_one_req Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x24d lib/dump_stack.c:53 panic+0x1e4/0x41c kernel/panic.c:183 __warn+0x1dc/0x200 kernel/panic.c:547 report_bug+0x1f4/0x2b0 lib/bug.c:186 fixup_bug.part.11+0x37/0x80 arch/x86/kernel/traps.c:178 fixup_bug arch/x86/kernel/traps.c:247 [inline] do_error_trap+0x2d7/0x3e0 arch/x86/kernel/traps.c:296 do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:315 invalid_op+0x1b/0x40 arch/x86/entry/entry_64.S:986 RIP: 0010:debug_print_object+0x166/0x220 lib/debugobjects.c:288 RSP: 0000:ffff8801d966f210 EFLAGS: 00010086 RAX: dffffc0000000008 RBX: 0000000000000003 RCX: ffffffff815acd6e RDX: 0000000000000000 RSI: 1ffff1003b2cddf2 RDI: 0000000000000000 RBP: ffff8801d966f250 R08: 0000000000000000 R09: 1ffff1003b2cddc8 R10: ffffed003b2cde71 R11: ffffffff86f39a98 R12: 0000000000000001 R13: ffffffff86f15540 R14: ffffffff86408700 R15: ffffffff8147c0a0 __debug_check_no_obj_freed lib/debugobjects.c:745 [inline] debug_check_no_obj_freed+0x662/0xf1f lib/debugobjects.c:774 kfree+0xc7/0x260 mm/slab.c:3799 process_one_req+0x2e7/0x6c0 drivers/infiniband/core/addr.c:592 process_one_work+0xc47/0x1bb0 kernel/workqueue.c:2113 worker_thread+0x223/0x1990 kernel/workqueue.c:2247 kthread+0x33c/0x400 kernel/kthread.c:238 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:406 Fixes: 5fff41e1f8 ("IB/core: Fix race condition in resolving IP to MAC") Reported-by: <syzbot+3b4acab09b6463472d0a@syzkaller.appspotmail.com> Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>		2018-03-27 13:19:01 -06:00
..
addr.c	RDMA/rdma_cm: Fix use after free race with process_one_req	2018-03-27 13:19:01 -06:00
agent.c
agent.h
cache.c	{net, IB}/mlx5: Manage port association for multiport RoCE	2018-01-08 11:42:22 -07:00
cgroup.c
cm.c	RDMA/cm: Fix access to uninitialized variable	2018-01-28 14:07:16 -07:00
cm_msgs.h
cma.c	RDMA/ucma: Fix access to non-initialized CM_ID object	2018-03-14 16:22:55 -04:00
cma_configfs.c	IB/cma: use strlcpy() instead of strncpy()	2018-01-15 15:33:21 -07:00
core_priv.h	RDMA/restrack: don't use uaccess_kernel()	2018-02-16 10:18:11 -07:00
cq.c	RDMA/core: Reduce poll batch for direct cq polling	2018-03-06 20:08:39 -07:00
device.c	RDMA/restrack: Move restrack_clean to be symmetrical to restrack_init	2018-03-21 14:22:22 -06:00
fmr_pool.c	infiniband: fix core/fmr_pool.c kernel-doc notation	2018-01-10 22:00:34 -07:00
iwcm.c	RDMA/netlink: Fix general protection fault	2017-12-07 15:28:07 -05:00
iwcm.h
iwpm_msg.c	RDMA/iwpm: Properly mark end of NL messages	2017-09-29 11:32:42 -04:00
iwpm_util.c	RDMA/iwpm: Fix uninitialized error code in iwpm_send_mapinfo()	2017-12-13 10:55:49 -07:00
iwpm_util.h
mad.c	drivers: infiniband: remove duplicate includes	2017-12-22 09:39:35 -07:00
mad_priv.h
mad_rmpp.c
mad_rmpp.h
Makefile	RDMA/restrack: Add general infrastructure to track RDMA resources	2018-01-29 20:21:39 -07:00
mr_pool.c
multicast.c
netlink.c	RDMA/netlink: Simplify code of autoload modules	2018-01-02 13:36:57 -07:00
nldev.c	RDMA/nldev: missing error code in nldev_res_get_doit()	2018-02-01 15:24:32 -07:00
opa_smi.h
packer.c
rdma_core.c	IB/uverbs: Fix unbalanced unlock on error path for rdma_explicit_destroy	2018-02-15 15:31:26 -07:00
rdma_core.h	IB/core: Add new ioctl interface	2017-08-31 08:35:09 -04:00
restrack.c	RDMA/restrack: don't use uaccess_kernel()	2018-02-16 10:18:11 -07:00
roce_gid_mgmt.c	{net, IB}/mlx5: Manage port association for multiport RoCE	2018-01-08 11:42:22 -07:00
rw.c	IB/core: remove redundant check on prot_sg_cnt	2017-10-10 10:49:45 -04:00
sa.h
sa_query.c	IB/core: Fix possible crash to access NULL netdev	2018-03-07 15:15:40 -05:00
security.c	Merge branch 'from-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git	2017-12-27 21:50:46 -07:00
smi.c
smi.h
sysfs.c	IB/core: Fix two kernel warnings triggered by rxe registration	2018-01-03 17:26:59 -07:00
ucm.c	vfs: do bulk POLL* -> EPOLL* replacement	2018-02-11 14:34:03 -08:00
ucma.c	RDMA/ucma: Correct option size check using optlen	2018-03-21 14:22:22 -06:00
ud_header.c
umem.c	IB/umem: Fix use of npages/nmap fields	2017-12-18 15:37:06 -07:00
umem_odp.c	RDMA/umem: Avoid partial declaration of non-static function	2017-11-10 13:02:12 -05:00
user_mad.c	vfs: do bulk POLL* -> EPOLL* replacement	2018-02-11 14:34:03 -08:00
uverbs.h	IB/uverbs: Allow CQ moderation with modify CQ	2017-11-13 16:59:22 -05:00
uverbs_cmd.c	RDMA/uverbs: Fix kernel panic while using XRC_TGT QP type	2018-02-21 13:52:19 -05:00
uverbs_ioctl.c	IB/uverbs: Fix possible oops with duplicate ioctl attributes	2018-02-15 14:59:46 -07:00
uverbs_ioctl_merge.c	IB/uverbs: Fix method merging in uverbs_ioctl_merge	2018-02-15 14:59:45 -07:00
uverbs_main.c	RDMA/uverbs: Protect from command mask overflow	2018-02-15 15:31:26 -07:00
uverbs_marshall.c	IB/core: Convert OPA AH to IB for Extended LIDs only	2017-11-13 15:53:57 -05:00
uverbs_std_types.c	IB/uverbs: Use u64_to_user_ptr() not a union	2018-02-15 14:59:45 -07:00
verbs.c	RDMA/restrack: don't use uaccess_kernel()	2018-02-16 10:18:11 -07:00