lkml.org 
[lkml]   [2022]   [May]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.15 056/135] RDMA/siw: Fix a condition race issue in MPA request processing
    Date
    From: Cheng Xu <chengyou@linux.alibaba.com>

    commit ef91271c65c12d36e4c2b61c61d4849fb6d11aa0 upstream.

    The calling of siw_cm_upcall and detaching new_cep with its listen_cep
    should be atomistic semantics. Otherwise siw_reject may be called in a
    temporary state, e,g, siw_cm_upcall is called but the new_cep->listen_cep
    has not being cleared.

    This fixes a WARN:

    WARNING: CPU: 7 PID: 201 at drivers/infiniband/sw/siw/siw_cm.c:255 siw_cep_put+0x125/0x130 [siw]
    CPU: 2 PID: 201 Comm: kworker/u16:22 Kdump: loaded Tainted: G E 5.17.0-rc7 #1
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
    Workqueue: iw_cm_wq cm_work_handler [iw_cm]
    RIP: 0010:siw_cep_put+0x125/0x130 [siw]
    Call Trace:
    <TASK>
    siw_reject+0xac/0x180 [siw]
    iw_cm_reject+0x68/0xc0 [iw_cm]
    cm_work_handler+0x59d/0xe20 [iw_cm]
    process_one_work+0x1e2/0x3b0
    worker_thread+0x50/0x3a0
    ? rescuer_thread+0x390/0x390
    kthread+0xe5/0x110
    ? kthread_complete_and_exit+0x20/0x20
    ret_from_fork+0x1f/0x30
    </TASK>

    Fixes: 6c52fdc244b5 ("rdma/siw: connection management")
    Link: https://lore.kernel.org/r/d528d83466c44687f3872eadcb8c184528b2e2d4.1650526554.git.chengyou@linux.alibaba.com
    Reported-by: Luis Chamberlain <mcgrof@kernel.org>
    Reviewed-by: Bernard Metzler <bmt@zurich.ibm.com>
    Signed-off-by: Cheng Xu <chengyou@linux.alibaba.com>
    Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/infiniband/sw/siw/siw_cm.c | 7 ++++---
    1 file changed, 4 insertions(+), 3 deletions(-)

    --- a/drivers/infiniband/sw/siw/siw_cm.c
    +++ b/drivers/infiniband/sw/siw/siw_cm.c
    @@ -968,14 +968,15 @@ static void siw_accept_newconn(struct si

    siw_cep_set_inuse(new_cep);
    rv = siw_proc_mpareq(new_cep);
    - siw_cep_set_free(new_cep);
    -
    if (rv != -EAGAIN) {
    siw_cep_put(cep);
    new_cep->listen_cep = NULL;
    - if (rv)
    + if (rv) {
    + siw_cep_set_free(new_cep);
    goto error;
    + }
    }
    + siw_cep_set_free(new_cep);
    }
    return;


    \
     
     \ /
      Last update: 2022-05-10 16:02    [W:4.044 / U:0.224 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site