On Wed, Mar 29, 2017 at 5:55 PM, Jason Gunthorpe <jgunthorpe@xxxxxxxxxxxxxxxxxxxx> wrote: > On Sun, Mar 19, 2017 at 05:59:04PM +0200, Matan Barak wrote: > >> +static void alloc_abort_fd_uobject(struct ib_uobject *uobj) >> +{ >> + struct ib_uobject_file *uobj_file = >> + container_of(uobj, struct ib_uobject_file, uobj); >> + struct file *filp = uobj->object; >> + int id = uobj_file->uobj.id; >> + >> + /* Unsuccessful NEW */ >> + fput(filp); >> + put_unused_fd(id); >> +} >> + >> +static int __must_check remove_commit_fd_uobject(struct ib_uobject *uobj, >> + enum rdma_remove_reason why) >> +{ >> + const struct uverbs_obj_fd_type *fd_type = >> + container_of(uobj->type, struct uverbs_obj_fd_type, type); >> + struct ib_uobject_file *uobj_file = >> + container_of(uobj, struct ib_uobject_file, uobj); >> + int ret = fd_type->context_closed(uobj_file, why); >> + >> + if (why == RDMA_REMOVE_DESTROY && ret) >> + return ret; >> + >> + if (why == RDMA_REMOVE_DURING_CLEANUP) { >> + alloc_abort_fd_uobject(uobj); > > Doesn't this call put_unused_fd on a fd that has actually been > installed? That isn't OK... > Nope, this is only called when we need to commit an object but we are for some reason in the cleanup process. If that happened, we have an initialized object. We can't add it to the list, as it's currently locked by the cleanup process. We can't just free it as it might allocated some hardware resources. So we need to destroy it with some unique specific reason. As stated, this is called straight from the commit uobject path. In that condition we didn't install the fd yet so that should be ok. > Jason Matan > -- > To unsubscribe from this list: send the line "unsubscribe linux-rdma" in > the body of a message to majordomo@xxxxxxxxxxxxxxx > More majordomo info at http://vger.kernel.org/majordomo-info.html -- To unsubscribe from this list: send the line "unsubscribe linux-rdma" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html