Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1235140
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 3.10 26/56] IB/uverbs: Fix race between ib_uverbs_open and remove_one |
| Date | 2015-09-29 16:10 +0200 |
| Message-ID | <qe3Lu-gh-41@gated-at.bofh.it> (permalink) |
| References | <qe3s5-85D-5@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
3.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yishai Hadas <yishaih@mellanox.com>
commit 35d4a0b63dc0c6d1177d4f532a9deae958f0662c upstream.
Fixes: 2a72f212263701b927559f6850446421d5906c41 ("IB/uverbs: Remove dev_table")
Before this commit there was a device look-up table that was protected
by a spin_lock used by ib_uverbs_open and by ib_uverbs_remove_one. When
it was dropped and container_of was used instead, it enabled the race
with remove_one as dev might be freed just after:
dev = container_of(inode->i_cdev, struct ib_uverbs_device, cdev) but
before the kref_get.
In addition, this buggy patch added some dead code as
container_of(x,y,z) can never be NULL and so dev can never be NULL.
As a result the comment above ib_uverbs_open saying "the open method
will either immediately run -ENXIO" is wrong as it can never happen.
The solution follows Jason Gunthorpe suggestion from below URL:
https://www.mail-archive.com/linux-rdma@vger.kernel.org/msg25692.html
cdev will hold a kref on the parent (the containing structure,
ib_uverbs_device) and only when that kref is released it is
guaranteed that open will never be called again.
In addition, fixes the active count scheme to use an atomic
not a kref to prevent WARN_ON as pointed by above comment
from Jason.
Signed-off-by: Yishai Hadas <yishaih@mellanox.com>
Signed-off-by: Shachar Raindel <raindel@mellanox.com>
Reviewed-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/core/uverbs.h | 3 +-
drivers/infiniband/core/uverbs_main.c | 43 +++++++++++++++++++++++-----------
2 files changed, 32 insertions(+), 14 deletions(-)
--- a/drivers/infiniband/core/uverbs.h
+++ b/drivers/infiniband/core/uverbs.h
@@ -69,7 +69,7 @@
*/
struct ib_uverbs_device {
- struct kref ref;
+ atomic_t refcount;
int num_comp_vectors;
struct completion comp;
struct device *dev;
@@ -78,6 +78,7 @@ struct ib_uverbs_device {
struct cdev cdev;
struct rb_root xrcd_tree;
struct mutex xrcd_tree_mutex;
+ struct kobject kobj;
};
struct ib_uverbs_event_file {
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -119,14 +119,18 @@ static ssize_t (*uverbs_cmd_table[])(str
static void ib_uverbs_add_one(struct ib_device *device);
static void ib_uverbs_remove_one(struct ib_device *device);
-static void ib_uverbs_release_dev(struct kref *ref)
+static void ib_uverbs_release_dev(struct kobject *kobj)
{
struct ib_uverbs_device *dev =
- container_of(ref, struct ib_uverbs_device, ref);
+ container_of(kobj, struct ib_uverbs_device, kobj);
- complete(&dev->comp);
+ kfree(dev);
}
+static struct kobj_type ib_uverbs_dev_ktype = {
+ .release = ib_uverbs_release_dev,
+};
+
static void ib_uverbs_release_event_file(struct kref *ref)
{
struct ib_uverbs_event_file *file =
@@ -282,13 +286,19 @@ static int ib_uverbs_cleanup_ucontext(st
return context->device->dealloc_ucontext(context);
}
+static void ib_uverbs_comp_dev(struct ib_uverbs_device *dev)
+{
+ complete(&dev->comp);
+}
+
static void ib_uverbs_release_file(struct kref *ref)
{
struct ib_uverbs_file *file =
container_of(ref, struct ib_uverbs_file, ref);
module_put(file->device->ib_dev->owner);
- kref_put(&file->device->ref, ib_uverbs_release_dev);
+ if (atomic_dec_and_test(&file->device->refcount))
+ ib_uverbs_comp_dev(file->device);
kfree(file);
}
@@ -629,9 +639,7 @@ static int ib_uverbs_open(struct inode *
int ret;
dev = container_of(inode->i_cdev, struct ib_uverbs_device, cdev);
- if (dev)
- kref_get(&dev->ref);
- else
+ if (!atomic_inc_not_zero(&dev->refcount))
return -ENXIO;
if (!try_module_get(dev->ib_dev->owner)) {
@@ -652,6 +660,7 @@ static int ib_uverbs_open(struct inode *
mutex_init(&file->mutex);
filp->private_data = file;
+ kobject_get(&dev->kobj);
return nonseekable_open(inode, filp);
@@ -659,13 +668,16 @@ err_module:
module_put(dev->ib_dev->owner);
err:
- kref_put(&dev->ref, ib_uverbs_release_dev);
+ if (atomic_dec_and_test(&dev->refcount))
+ ib_uverbs_comp_dev(dev);
+
return ret;
}
static int ib_uverbs_close(struct inode *inode, struct file *filp)
{
struct ib_uverbs_file *file = filp->private_data;
+ struct ib_uverbs_device *dev = file->device;
ib_uverbs_cleanup_ucontext(file, file->ucontext);
@@ -673,6 +685,7 @@ static int ib_uverbs_close(struct inode
kref_put(&file->async_file->ref, ib_uverbs_release_event_file);
kref_put(&file->ref, ib_uverbs_release_file);
+ kobject_put(&dev->kobj);
return 0;
}
@@ -768,10 +781,11 @@ static void ib_uverbs_add_one(struct ib_
if (!uverbs_dev)
return;
- kref_init(&uverbs_dev->ref);
+ atomic_set(&uverbs_dev->refcount, 1);
init_completion(&uverbs_dev->comp);
uverbs_dev->xrcd_tree = RB_ROOT;
mutex_init(&uverbs_dev->xrcd_tree_mutex);
+ kobject_init(&uverbs_dev->kobj, &ib_uverbs_dev_ktype);
spin_lock(&map_lock);
devnum = find_first_zero_bit(dev_map, IB_UVERBS_MAX_DEVICES);
@@ -798,6 +812,7 @@ static void ib_uverbs_add_one(struct ib_
cdev_init(&uverbs_dev->cdev, NULL);
uverbs_dev->cdev.owner = THIS_MODULE;
uverbs_dev->cdev.ops = device->mmap ? &uverbs_mmap_fops : &uverbs_fops;
+ uverbs_dev->cdev.kobj.parent = &uverbs_dev->kobj;
kobject_set_name(&uverbs_dev->cdev.kobj, "uverbs%d", uverbs_dev->devnum);
if (cdev_add(&uverbs_dev->cdev, base, 1))
goto err_cdev;
@@ -828,9 +843,10 @@ err_cdev:
clear_bit(devnum, overflow_map);
err:
- kref_put(&uverbs_dev->ref, ib_uverbs_release_dev);
+ if (atomic_dec_and_test(&uverbs_dev->refcount))
+ ib_uverbs_comp_dev(uverbs_dev);
wait_for_completion(&uverbs_dev->comp);
- kfree(uverbs_dev);
+ kobject_put(&uverbs_dev->kobj);
return;
}
@@ -850,9 +866,10 @@ static void ib_uverbs_remove_one(struct
else
clear_bit(uverbs_dev->devnum - IB_UVERBS_MAX_DEVICES, overflow_map);
- kref_put(&uverbs_dev->ref, ib_uverbs_release_dev);
+ if (atomic_dec_and_test(&uverbs_dev->refcount))
+ ib_uverbs_comp_dev(uverbs_dev);
wait_for_completion(&uverbs_dev->comp);
- kfree(uverbs_dev);
+ kobject_put(&uverbs_dev->kobj);
}
static char *uverbs_devnode(struct device *dev, umode_t *mode)
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH 3.10 00/56] 3.10.90-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 15:50 +0200
[PATCH 3.10 01/56] unshare: Unsharing a thread does not require unsharing a vm Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 15:50 +0200
[PATCH 3.10 04/56] mac80211: enable assoc check for mesh interfaces Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 15:50 +0200
[PATCH 3.10 02/56] rtlwifi: rtl8192cu: Add new device ID Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 15:50 +0200
[PATCH 3.10 17/56] NFS: nfs_set_pgio_error sometimes misses errors Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 15:50 +0200
[PATCH 3.10 25/56] IB/uverbs: reject invalid or unknown opcodes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 15:50 +0200
[PATCH 3.10 40/56] net: Fix skb csum races when peeking Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 16:00 +0200
[PATCH 3.10 43/56] isdn/gigaset: reset tty->receive_room when attaching ser_gigaset Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 16:00 +0200
[PATCH 3.10 55/56] vfs: Remove incorrect debugging WARN in prepend_path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 16:00 +0200
[PATCH 3.10 29/56] stmmac: fix check for phydev being open Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 16:00 +0200
Re: [PATCH 3.10 29/56] stmmac: fix check for phydev being open Sergei Shtylyov <sergei.shtylyov@cogentembedded.com> - 2015-09-30 13:30 +0200
[PATCH 3.10 49/56] ip6_gre: release cached dst on tunnel removal Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 16:00 +0200
[PATCH 3.10 27/56] IB/mlx4: Forbid using sysfs to change RoCE pkeys Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 16:00 +0200
[PATCH 3.10 31/56] sctp: fix ASCONF list handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 16:00 +0200
[PATCH 3.10 41/56] net: Fix skb_set_peeked use-after-free bug Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 16:00 +0200
[PATCH 3.10 32/56] vhost/scsi: potential memory corruption Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 16:00 +0200
[PATCH 3.10 30/56] hfs,hfsplus: cache pages correctly between bnode_create and bnode_free Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 16:00 +0200
[PATCH 3.10 35/56] net/tipc: initialize security state for new connection socket Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 16:00 +0200
[PATCH 3.10 52/56] net/ipv6: Correct PIM6 mrt_lock handling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 16:00 +0200
[PATCH 3.10 50/56] usbnet: Get EVENT_NO_RUNTIME_PM bit before it is cleared Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 16:00 +0200
[PATCH 3.10 44/56] ipv6: lock socket in ip6_datagram_connect() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 16:00 +0200
[PATCH 3.10 42/56] bridge: mdb: fix double add notification Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 16:00 +0200
[PATCH 3.10 33/56] x86: bpf_jit: fix compilation of large bpf programs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 16:00 +0200
[PATCH 3.10 37/56] net: pktgen: fix race between pktgen_thread_worker() and kthread_stop() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 16:00 +0200
[PATCH 3.10 45/56] bonding: fix destruction of bond with devices different from arphrd_ether Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 16:00 +0200
[PATCH 3.10 53/56] sctp: fix race on protocol/netns initialization Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 16:00 +0200
[PATCH 3.10 47/56] netlink: dont hold mutex in rcu callback when releasing mmapd ring Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 16:00 +0200
[PATCH 3.10 36/56] bridge: mdb: zero out the local br_ip variable before use Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 16:00 +0200
[PATCH 3.10 48/56] rds: fix an integer overflow test in rds_info_getsockopt() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 16:00 +0200
Re: [PATCH 3.10 08/56] Input: synaptics - fix handling of disabling gesture mode Dmitry Torokhov <dmitry.torokhov@gmail.com> - 2015-09-29 16:00 +0200
Re: [PATCH 3.10 08/56] Input: synaptics - fix handling of disabling gesture mode Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 16:20 +0200
[PATCH 3.10 56/56] Revert "iio: bmg160: IIO_BUFFER and IIO_TRIGGERED_BUFFER are required" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 16:00 +0200
[PATCH 3.10 38/56] net: call rcu_read_lock early in process_backlog Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 16:00 +0200
[PATCH 3.10 54/56] fib_rules: fix fib rule dumps across multiple skbs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 16:00 +0200
[PATCH 3.10 46/56] inet: frags: fix defragmented packets IP header for af_packet Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 16:00 +0200
[PATCH 3.10 34/56] ipv6: Make MLD packets to only be processed locally Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 16:00 +0200
[PATCH 3.10 51/56] ipv6: fix exthdrs offload registration in out_rt path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 16:00 +0200
[PATCH 3.10 39/56] net: Clone skb before setting peeked flag Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 16:00 +0200
[PATCH 3.10 03/56] tg3: Fix temperature reporting Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 16:10 +0200
[PATCH 3.10 22/56] md/raid10: always set reshape_safe when initializing reshape_position. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 16:10 +0200
[PATCH 3.10 18/56] parisc: Filter out spurious interrupts in PA-RISC irq handler Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 16:10 +0200
[PATCH 3.10 13/56] Add radeon suspend/resume quirk for HP Compaq dc5750. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 16:10 +0200
[PATCH 3.10 16/56] NFSv4: dont set SETATTR for O_RDONLY|O_EXCL Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 16:10 +0200
[PATCH 3.10 20/56] fs: if a coredump already exists, unlink and recreate with O_EXCL Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 16:10 +0200
[PATCH 3.10 08/56] Input: synaptics - fix handling of disabling gesture mode Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 16:10 +0200
[PATCH 3.10 06/56] arm64: compat: fix vfp save/restore across signal handlers in big-endian Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 16:10 +0200
[PATCH 3.10 21/56] mmc: core: fix race condition in mmc_wait_data_done Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 16:10 +0200
[PATCH 3.10 24/56] hfs: fix B-tree corruption after insertion at position 0 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 16:10 +0200
[PATCH 3.10 19/56] vmscan: fix increasing nr_isolated incurred by putback unevictable pages Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 16:10 +0200
[PATCH 3.10 12/56] powerpc/rtas: Introduce rtas_get_sensor_fast() for IRQ handlers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 16:10 +0200
[PATCH 3.10 11/56] powerpc/mm: Fix pte_pagesize_index() crash on 4K w/64K hash Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 16:10 +0200
[PATCH 3.10 07/56] arm64: head.S: initialise mdcr_el2 in el2_setup Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 16:10 +0200
[PATCH 3.10 26/56] IB/uverbs: Fix race between ib_uverbs_open and remove_one Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-29 16:10 +0200
Re: [PATCH 3.10 00/56] 3.10.90-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2015-09-29 19:00 +0200
Re: [PATCH 3.10 00/56] 3.10.90-stable review Guenter Roeck <linux@roeck-us.net> - 2015-09-29 23:20 +0200
Re: [PATCH 3.10 00/56] 3.10.90-stable review Sudip Mukherjee <sudipm.mukherjee@gmail.com> - 2015-09-30 07:50 +0200
csiph-web