Re: Maybe a race condition in net/rds/rdma.c?

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 3/6/20 4:11 AM, zerons wrote:


On 2/28/20 02:10, santosh.shilimkar@xxxxxxxxxx wrote:

On 18 Feb 2020, at 14:13, zerons <sironhide0null@xxxxxxxxx> wrote:

Hi, all

In net/rds/rdma.c
(https://urldefense.com/v3/__https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/net/rds/rdma.c?h=v5.5.3*n419__;Iw!!GqivPVa7Brio!OwwQCLtjDsKmhaIz0sfaOVSuC4ai5t5_FgB7yqNExGOCBtACtIGLF61NNJyqSDtIAcGoPg$ ),
there may be a race condition between rds_rdma_unuse() and rds_free_mr().

Hmmm.. I didn't see email before in my inbox. Please post questions/patches on netdev in future which is the correct mailing list.

It seems that this one need some specific devices to run test,
unfortunately, I don't have any of these.
I've already sent two emails to the maintainer for help, no response yet,
(the email address may not be in use).

0) in rds_recv_incoming_exthdrs(), it calls rds_rdma_unuse() when receive an
extension header with force=0, if the victim mr does not have RDS_RDMA_USE_ONCE
flag set, then the mr would stay in the rbtree. Without any lock, it tries to
call mr->r_trans->sync_mr().

MR won't stay in the rbtree with force flag. If the MR is used or
use_once is set in both cases its removed from the tree.
See "if (mr->r_use_once || force)"

1) in rds_free_mr(), the same mr is found, and then freed. The mr->r_refcount
doesn't change while rds_mr_tree_walk().

0) back in rds_rdma_unuse(), the victim mr get used again, call
mr->r_trans->sync_mr().

Could this race condition actually happen?
So from what I see, this race doesn't exist but let me know
if am missing something.

regards,
Santosh



[Index of Archives]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Photo]     [Yosemite News]     [Yosemite Photos]     [Linux Kernel]     [Linux SCSI]     [XFree86]

  Powered by Linux