Commit 09e328e4 authored by Jason Gunthorpe's avatar Jason Gunthorpe
Browse files

RDMA/ucma: Fix the locking of ctx->file 

ctx->file is changed under the file->mut lock by ucma_migrate_id(), which
is impossible to lock correctly. Instead change ctx->file under the
handler_lock and ctx_table lock and revise all places touching ctx->file
to use this locking when reading ctx->file.

Link: https://lore.kernel.org/r/20200818120526.702120-9-leon@kernel.org


Signed-off-by: default avatarLeon Romanovsky <leonro@mellanox.com>
Signed-off-by: default avatarJason Gunthorpe <jgg@nvidia.com>
parent 308571de

drivers/infiniband/core/ucma.c

+5 −1
Original line number Diff line number Diff line
@@ -547,6 +547,7 @@ static void ucma_cleanup_mc_events(struct ucma_multicast *mc) 
{

	struct ucma_event *uevent, *tmp;



	rdma_lock_handler(mc->ctx->cm_id);

	mutex_lock(&mc->ctx->file->mut);

	list_for_each_entry_safe(uevent, tmp, &mc->ctx->file->event_list, list) {

		if (uevent->mc != mc)
@@ -556,6 +557,7 @@ static void ucma_cleanup_mc_events(struct ucma_multicast *mc) 
		kfree(uevent);

	}

	mutex_unlock(&mc->ctx->file->mut);

	rdma_unlock_handler(mc->ctx->cm_id);

}



/*
@@ -1600,7 +1602,7 @@ static ssize_t ucma_leave_multicast(struct ucma_file *file, 
	mc = xa_load(&multicast_table, cmd.id);

	if (!mc)

		mc = ERR_PTR(-ENOENT);

	else if (mc->ctx->file != file)

	else if (READ_ONCE(mc->ctx->file) != file)

		mc = ERR_PTR(-EINVAL);

	else if (!refcount_inc_not_zero(&mc->ctx->ref))

		mc = ERR_PTR(-ENXIO);
@@ -1692,6 +1694,7 @@ static ssize_t ucma_migrate_id(struct ucma_file *new_file, 
		goto file_put;

	}



	rdma_lock_handler(ctx->cm_id);

	cur_file = ctx->file;

	if (cur_file == new_file) {

		resp.events_reported = ctx->events_reported;
@@ -1718,6 +1721,7 @@ response: 
			 &resp, sizeof(resp)))

		ret = -EFAULT;



	rdma_unlock_handler(ctx->cm_id);

	ucma_put_ctx(ctx);

file_put:

	fdput(f);

CRA Git | Maintained and supported by SUSTech CRA and CCSE