On 2/28/20 02:10, santosh.shilimkar@xxxxxxxxxx wrote: > >>> On 18 Feb 2020, at 14:13, zerons <sironhide0null@xxxxxxxxx> wrote: >>> >>> Hi, all >>> >>> In net/rds/rdma.c >>> (https://urldefense.com/v3/__https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/net/rds/rdma.c?h=v5.5.3*n419__;Iw!!GqivPVa7Brio!OwwQCLtjDsKmhaIz0sfaOVSuC4ai5t5_FgB7yqNExGOCBtACtIGLF61NNJyqSDtIAcGoPg$ ), >>> there may be a race condition between rds_rdma_unuse() and rds_free_mr(). >>> > Hmmm.. I didn't see email before in my inbox. Please post questions/patches on netdev in future which is the correct mailing list. > >>> It seems that this one need some specific devices to run test, >>> unfortunately, I don't have any of these. >>> I've already sent two emails to the maintainer for help, no response yet, >>> (the email address may not be in use). >>> >>> 0) in rds_recv_incoming_exthdrs(), it calls rds_rdma_unuse() when receive an >>> extension header with force=0, if the victim mr does not have RDS_RDMA_USE_ONCE >>> flag set, then the mr would stay in the rbtree. Without any lock, it tries to >>> call mr->r_trans->sync_mr(). >>> >>> 1) in rds_free_mr(), the same mr is found, and then freed. The mr->r_refcount >>> doesn't change while rds_mr_tree_walk(). >>> >>> 0) back in rds_rdma_unuse(), the victim mr get used again, call >>> mr->r_trans->sync_mr(). >>> >>> Could this race condition actually happen? >>> > force=0 is an interesting scenario. Let me think about it and get back. > Thanks for report. > > Regards, > Santosh Thanks for your attention. Regards,
