linux-kernel - Re: [PATCH 4.19 03/79] RDMA/restrack: Release task struct which was hold by CM

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sat, 21 Sep 2019 22:22:10 +0200
From:   Pavel Machek <pavel@...x.de>
To:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc:     linux-kernel@...r.kernel.org, stable@...r.kernel.org,
        Artemy Kovalyov <artemyko@...lanox.com>,
        Yossi Itigin <yosefe@...lanox.com>,
        Leon Romanovsky <leonro@...lanox.com>,
        Steve Wise <swise@...ngridcomputing.com>,
        Jason Gunthorpe <jgg@...lanox.com>,
        Håkon Bugge <haakon.bugge@...cle.com>
Subject: Re: [PATCH 4.19 03/79] RDMA/restrack: Release task struct which was
 hold by CM_ID object

Hi!

> commit ed7a01fd3fd77f40b4ef2562b966a5decd8928d2 upstream.
> 
> Tracking CM_ID resource is performed in two stages: creation of cm_id
> and connecting it to the cma_dev. It is needed because rdma-cm protocol
> exports two separate user-visible calls rdma_create_id and
> rdma_accept.
...

Mainline says this needs additional fix, fe9bc1644918aa1d, see below.

> --- a/drivers/infiniband/core/restrack.c
> +++ b/drivers/infiniband/core/restrack.c
> @@ -209,7 +209,7 @@ void rdma_restrack_del(struct rdma_restr
>  	struct ib_device *dev;
>  
>  	if (!res->valid)
> -		return;
> +		goto out;
>  
>  	dev = res_to_dev(res);
>  	if (!dev)
#                 return;

This test does return, does it need to go through 'goto out', too? (I
see it should not happen, but...)

> @@ -222,8 +222,10 @@ void rdma_restrack_del(struct rdma_restr
>  	down_write(&dev->res.rwsem);
>  	hash_del(&res->node);
>  	res->valid = false;
> +	up_write(&dev->res.rwsem);
> +
> +out:
>  	if (res->task)
>  		put_task_struct(res->task);
> -	up_write(&dev->res.rwsem);
>  }

Mainline says res->task = NULL is needed there, see fe9bc1644918aa1d.

Best regards,
									Pavel
-- 
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html

Download attachment "signature.asc" of type "application/pgp-signature" (182 bytes)