Re: rdma_rxe use-after-free

[Bart Van Assche <bvanassche@xxxxxxx>]

On Sun, 2019-01-20 at 09:06 +-0800, Yanjun Zhu wrote:
+AD4 diff --git a/drivers/infiniband/sw/rxe/rxe+AF8-resp.c 
+AD4 b/drivers/infiniband/sw/rxe/rxe+AF8-resp.c
+AD4 index aca9f60f9b21..dc89562393e1 100644
+AD4 --- a/drivers/infiniband/sw/rxe/rxe+AF8-resp.c
+AD4 +-+-+- b/drivers/infiniband/sw/rxe/rxe+AF8-resp.c
+AD4 +AEAAQA -112,7 +-112,9 +AEAAQA void rxe+AF8-resp+AF8-queue+AF8-pkt(struct rxe+AF8-qp +ACo-qp, struct 
+AD4 sk+AF8-buff +ACo-skb)
+AD4          skb+AF8-queue+AF8-tail(+ACY-qp-+AD4-req+AF8-pkts, skb)+ADs
+AD4 
+AD4          must+AF8-sched +AD0 (pkt-+AD4-opcode +AD0APQ IB+AF8-OPCODE+AF8-RC+AF8-RDMA+AF8-READ+AF8-REQUEST) +AHwAfA
+AD4 -                       (skb+AF8-queue+AF8-len(+ACY-qp-+AD4-req+AF8-pkts) +AD4 1)+ADs
+AD4 +-                       (skb+AF8-queue+AF8-len(+ACY-qp-+AD4-req+AF8-pkts) +AD4 1) +AHwAfA
+AD4 +-                       ((+ACY-qp-+AD4-resp.task)-+AD4-state +AD0APQ TASK+AF8-STATE+AF8-BUSY) +AHwAfA
+AD4 +-                       ((+ACY-qp-+AD4-resp.task)-+AD4-state +AD0APQ TASK+AF8-STATE+AF8-ARMED)+ADs
+AD4 
+AD4          rxe+AF8-run+AF8-task(+ACY-qp-+AD4-resp.task, must+AF8-sched)+ADs
+AD4   +AH0
+AD4 
+AD4 Please make tests with the above.
+AD4 
+AD4 Zhu Yanjun

Hi Yanjun,

Thanks for having taken a look.

As far as I can see the rxe+AF8-resp+AF8-queue+AF8-pkt() caller does not hold the task
state+AF8-lock, the lock that protects task state changes. So the task state
can change while rxe+AF8-resp+AF8-queue+AF8-pkt() is in progress. Isn't that a race
condition that prevents the above patch to be a proper fix?

Thanks,

Bart.