This is a note to let you know that I've just added the patch titled RDMA/core: Fix race between destroy and release FD object to the 4.19-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: rdma-core-fix-race-between-destroy-and-release-fd-object.patch and it can be found in the queue-4.19 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From f0abc761bbb9418876cc4d1ebc473e4ea6352e42 Mon Sep 17 00:00:00 2001 From: Leon Romanovsky <leon@xxxxxxxxxx> Date: Thu, 23 Apr 2020 09:01:22 +0300 Subject: RDMA/core: Fix race between destroy and release FD object From: Leon Romanovsky <leonro@xxxxxxxxxxxx> commit f0abc761bbb9418876cc4d1ebc473e4ea6352e42 upstream. The call to ->lookup_put() was too early and it caused an unlock of the read/write protection of the uobject after the FD was put. This allows a race: CPU1 CPU2 rdma_lookup_put_uobject() lookup_put_fd_uobject() fput() fput() uverbs_uobject_fd_release() WARN_ON(uverbs_try_lock_object(uobj, UVERBS_LOOKUP_WRITE)); atomic_dec(usecnt) Fix the code by changing the order, first unlock and call to ->lookup_put() after that. Fixes: 3832125624b7 ("IB/core: Add support for idr types") Link: https://lore.kernel.org/r/20200423060122.6182-1-leon@xxxxxxxxxx Suggested-by: Jason Gunthorpe <jgg@xxxxxxxxxxxx> Signed-off-by: Leon Romanovsky <leonro@xxxxxxxxxxxx> Signed-off-by: Jason Gunthorpe <jgg@xxxxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- drivers/infiniband/core/rdma_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/infiniband/core/rdma_core.c +++ b/drivers/infiniband/core/rdma_core.c @@ -697,7 +697,6 @@ void rdma_lookup_put_uobject(struct ib_u enum rdma_lookup_mode mode) { assert_uverbs_usecnt(uobj, mode); - uobj->uapi_object->type_class->lookup_put(uobj, mode); /* * In order to unlock an object, either decrease its usecnt for * read access or zero it in case of exclusive access. See @@ -714,6 +713,7 @@ void rdma_lookup_put_uobject(struct ib_u break; } + uobj->uapi_object->type_class->lookup_put(uobj, mode); /* Pairs with the kref obtained by type->lookup_get */ uverbs_uobject_put(uobj); } Patches currently in stable-queue which might be from leon@xxxxxxxxxx are queue-4.19/rdma-mlx4-initialize-ib_spec-on-the-stack.patch queue-4.19/rdma-core-fix-race-between-destroy-and-release-fd-object.patch queue-4.19/rdma-mlx5-set-grh-fields-in-query-qp-on-roce.patch queue-4.19/rdma-core-prevent-mixed-use-of-fds-between-shared-ufiles.patch