netdev - Re: [PATCH v3 for-next 05/13] IB/cm: Reference count ib_cm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 11 May 2015 12:34:59 -0600
From:	Jason Gunthorpe <jgunthorpe@...idianresearch.com>
To:	Haggai Eran <haggaie@...lanox.com>
Cc:	Doug Ledford <dledford@...hat.com>, linux-rdma@...r.kernel.org,
	netdev@...r.kernel.org, Liran Liss <liranl@...lanox.com>,
	Guy Shapiro <guysh@...lanox.com>,
	Shachar Raindel <raindel@...lanox.com>,
	Yotam Kenneth <yotamke@...lanox.com>
Subject: Re: [PATCH v3 for-next 05/13] IB/cm: Reference count ib_cm_ids

On Sun, May 10, 2015 at 01:26:36PM +0300, Haggai Eran wrote:
> Add reference count (kref) to the ib_cm_id to allow automatic destruction
> of an ib_cm_id. This will allow multiple RDMA CM IDs to use a single
> ib_cm_id when they are on different network namespaces.
> 
> Signed-off-by: Haggai Eran <haggaie@...lanox.com>
>  drivers/infiniband/core/cm.c | 41 +++++++++++++++++++++++++++++++++++++----
>  include/rdma/ib_cm.h         | 10 +++++++---
>  2 files changed, 44 insertions(+), 7 deletions(-)
> 
> diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
> index 08b18044552a..6b68402fd6df 100644
> +++ b/drivers/infiniband/core/cm.c
> @@ -711,6 +711,7 @@ struct ib_cm_id *ib_create_cm_id(struct ib_device *device,
>  	cm_id_priv->id.cm_handler = cm_handler;
>  	cm_id_priv->id.context = context;
>  	cm_id_priv->id.remote_cm_qpn = 1;
> +	kref_init(&cm_id_priv->id.ref);
>  	ret = cm_alloc_id(cm_id_priv);
>  	if (ret)
>  		goto error;

Idiomatically, once kref_init is called, kfree should not be used, you
have to kref_put to destroy it, this error path calls kfree directly.

Probably best to just move the kref_init to after the failable call.

> -void ib_destroy_cm_id(struct ib_cm_id *cm_id)
> +static void __ib_destroy_cm_id(struct kref *ref)
>  {
> +	struct ib_cm_id *cm_id = container_of(ref, struct ib_cm_id, ref);
> +
>  	cm_destroy_id(cm_id, 0);
>  }

Hum, this is quite a heavy free function. Did you check that this is
safe to do asynchronously, that there are no implicit kref's being
held by the caller?

Jason
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html