linux-kernel - Re: [PATCH v2] RDMA/cma: Fix workqueue crash in cma_netevent_work

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <e147d7c5-1acf-495c-8d42-298b025b7a00@oracle.com>
Date: Wed, 9 Apr 2025 09:39:30 -0700
From: Sharath Srinivasan <sharath.srinivasan@...cle.com>
To: Leon Romanovsky <leon@...nel.org>, jgg@...pe.ca, phaddad@...dia.com,
        markzhang@...dia.com
Cc: linux-rdma@...r.kernel.org, linux-kernel@...r.kernel.org,
        stable@...r.kernel.org, haakon.bugge@...cle.com,
        aron.silverton@...cle.com
Subject: Re: [PATCH v2] RDMA/cma: Fix workqueue crash in
 cma_netevent_work_handler



On 2025-04-09 4:20 a.m., Leon Romanovsky wrote:
> 
> On Wed, 26 Mar 2025 14:05:32 -0700, Sharath Srinivasan wrote:
>> struct rdma_cm_id has member "struct work_struct net_work"
>> that is reused for enqueuing cma_netevent_work_handler()s
>> onto cma_wq.
>>
>> Below crash[1] can occur if more than one call to
>> cma_netevent_callback() occurs in quick succession,
>> which further enqueues cma_netevent_work_handler()s for the
>> same rdma_cm_id, overwriting any previously queued work-item(s)
>> that was just scheduled to run i.e. there is no guarantee
>> the queued work item may run between two successive calls
>> to cma_netevent_callback() and the 2nd INIT_WORK would overwrite
>> the 1st work item (for the same rdma_cm_id), despite grabbing
>> id_table_lock during enqueue.
>>
>> [...]
> 
> Applied, thanks!
> 
> [1/1] RDMA/cma: Fix workqueue crash in cma_netevent_work_handler
>       https://urldefense.com/v3/__https://git.kernel.org/rdma/rdma/c/052996ebc39e3e__;!!ACWV5N9M2RV99hQ!LLGepcc45JwMb6s1VnxWb4Y2hyAGH7AZaE1BoDtVREqdciSOHOIlKiu4RvKD9bL5NYAEtIMG6oVL2cU7PQ$ 
> 
> Best regards,

Thank you, Leon and Patrisious!

Best Regards,
Sharath