Re: [PATCH rdma-next] RDMA/odp: Fix use-after-free bug in releasing ucontext

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Fri, Sep 07, 2018 at 09:05:43PM +0300, Leon Romanovsky wrote:
> On Fri, Sep 07, 2018 at 08:40:10PM +0300, Leon Romanovsky wrote:
> > On Thu, Sep 06, 2018 at 09:55:19PM -0600, Jason Gunthorpe wrote:
> > > On Wed, Sep 05, 2018 at 05:21:37PM -0600, Jason Gunthorpe wrote:
> > >
> > > > Instead hold on to the actual mm directly inside the umme via mmgrab()
> > > > and mmdrop(), just like mmu_notifiers already does internally.
> > >
> > > I coded up a series to do this, and more:
> > >
> > > https://github.com/jgunthorpe/linux/commits/tgid_removal
> > >
> > > I'll try to test it later, but it is the general idea.. ucontext->tgid
> > > is an abomination and needs to be deleted.
> > >
> > > Have to do some testing on it..
> >
> > I tried the series with my repro for use-after-free bug in ODP plus reverted
> > commit "50704e039ab1 RDMA/umem: Restore lockdep check while downgrading lock"
> > just to be sure and got the following splat. I have similar lockdep
> > warning without reverting too.
> 
> Something changed in my test system, I'm receiving such warning without
> your patches, with reverted "lockdep" patch and reverted this ODP patch.

I would expect reg_mr/dereg_mr to instantly cause this splat very
reliably.. Assuming the tgid madness is working.

Jason



[Index of Archives]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Photo]     [Yosemite News]     [Yosemite Photos]     [Linux Kernel]     [Linux SCSI]     [XFree86]

  Powered by Linux