This is a note to let you know that I've just added the patch titled
RDMA/core: Fix race between destroy and release FD object
to the 5.6-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
rdma-core-fix-race-between-destroy-and-release-fd-object.patch
and it can be found in the queue-5.6 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From f0abc761bbb9418876cc4d1ebc473e4ea6352e42 Mon Sep 17 00:00:00 2001
From: Leon Romanovsky <leon@xxxxxxxxxx>
Date: Thu, 23 Apr 2020 09:01:22 +0300
Subject: RDMA/core: Fix race between destroy and release FD object
From: Leon Romanovsky <leonro@xxxxxxxxxxxx>
commit f0abc761bbb9418876cc4d1ebc473e4ea6352e42 upstream.
The call to ->lookup_put() was too early and it caused an unlock of the
read/write protection of the uobject after the FD was put. This allows a
race:
CPU1 CPU2
rdma_lookup_put_uobject()
lookup_put_fd_uobject()
fput()
fput()
uverbs_uobject_fd_release()
WARN_ON(uverbs_try_lock_object(uobj,
UVERBS_LOOKUP_WRITE));
atomic_dec(usecnt)
Fix the code by changing the order, first unlock and call to
->lookup_put() after that.
Fixes: 3832125624b7 ("IB/core: Add support for idr types")
Link: https://lore.kernel.org/r/20200423060122.6182-1-leon@xxxxxxxxxx
Suggested-by: Jason Gunthorpe <jgg@xxxxxxxxxxxx>
Signed-off-by: Leon Romanovsky <leonro@xxxxxxxxxxxx>
Signed-off-by: Jason Gunthorpe <jgg@xxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
drivers/infiniband/core/rdma_core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/infiniband/core/rdma_core.c
+++ b/drivers/infiniband/core/rdma_core.c
@@ -678,7 +678,6 @@ void rdma_lookup_put_uobject(struct ib_u
enum rdma_lookup_mode mode)
{
assert_uverbs_usecnt(uobj, mode);
- uobj->uapi_object->type_class->lookup_put(uobj, mode);
/*
* In order to unlock an object, either decrease its usecnt for
* read access or zero it in case of exclusive access. See
@@ -695,6 +694,7 @@ void rdma_lookup_put_uobject(struct ib_u
break;
}
+ uobj->uapi_object->type_class->lookup_put(uobj, mode);
/* Pairs with the kref obtained by type->lookup_get */
uverbs_uobject_put(uobj);
}
Patches currently in stable-queue which might be from leon@xxxxxxxxxx are
queue-5.6/rdma-cm-fix-ordering-of-xa_alloc_cyclic-in-ib_create_cm_id.patch
queue-5.6/rdma-mlx4-initialize-ib_spec-on-the-stack.patch
queue-5.6/rdma-core-fix-race-between-destroy-and-release-fd-object.patch
queue-5.6/rdma-core-fix-overwriting-of-uobj-in-case-of-error.patch
queue-5.6/rdma-mlx5-set-grh-fields-in-query-qp-on-roce.patch
queue-5.6/rdma-core-prevent-mixed-use-of-fds-between-shared-ufiles.patch
queue-5.6/rdma-uverbs-fix-a-race-with-disassociate-and-exit_mmap.patch
