linux-kernel - RE: qib_lookup_qpn() appears to leak pointer out of rcu_read

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 12 Feb 2014 14:57:14 +0000
From:	"Marciniszyn, Mike" <mike.marciniszyn@...el.com>
To:	"paulmck@...ux.vnet.ibm.com" <paulmck@...ux.vnet.ibm.com>
CC:	"roland@...nel.org" <roland@...nel.org>,
	"Hefty, Sean" <sean.hefty@...el.com>,
	"hal.rosenstock@...il.com" <hal.rosenstock@...il.com>,
	"linux-rdma@...r.kernel.org" <linux-rdma@...r.kernel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: RE: qib_lookup_qpn() appears to leak pointer out of
 rcu_read_unlock()

BTW, I am considering eliminating the atomic_inc() in favor of widening the scope of the rcu lock expanse.

Mike

> -----Original Message-----
> From: Paul E. McKenney [mailto:paulmck@...ux.vnet.ibm.com]
> Sent: Wednesday, February 12, 2014 9:56 AM
> To: Marciniszyn, Mike
> Cc: roland@...nel.org; Hefty, Sean; hal.rosenstock@...il.com; linux-
> rdma@...r.kernel.org; linux-kernel@...r.kernel.org
> Subject: Re: qib_lookup_qpn() appears to leak pointer out of rcu_read_unlock()
> 
> On Wed, Feb 12, 2014 at 01:59:30PM +0000, Marciniszyn, Mike wrote:
> > > So what am I missing here?
> > >
> >
> > The atomic increment of a reference count:
> 
> Got it, thank you, apologies for the noise!
> 
> 							Thanx, Paul
> 
> > struct qib_qp *qib_lookup_qpn(struct qib_ibport *ibp, u32 qpn) {
> >         struct qib_qp *qp = NULL;
> >
> >         rcu_read_lock();
> >         if (unlikely(qpn <= 1)) {
> >                 if (qpn == 0)
> >                         qp = rcu_dereference(ibp->qp0);
> >                 else
> >                         qp = rcu_dereference(ibp->qp1);
> >                 if (qp)
> >                         atomic_inc(&qp->refcount); <--------------------------
> >         } else {
> >                 struct qib_ibdev *dev = &ppd_from_ibp(ibp)->dd->verbs_dev;
> >                 unsigned n = qpn_hash(dev, qpn);
> >
> >                 for (qp = rcu_dereference(dev->qp_table[n]); qp;
> >                         qp = rcu_dereference(qp->next))
> >                         if (qp->ibqp.qp_num == qpn) {
> >                                 atomic_inc(&qp->refcount); <---------------------
> >                                 break;
> >                         }
> >         }
> >         rcu_read_unlock();
> >         return qp;
> > }
> >
> > Mike
> >

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/