From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Krishnamraju Eraparaju <krishna2@chelsio.com>,
Bernard Metzler <bmt@zurich.ibm.com>,
Jason Gunthorpe <jgg@mellanox.com>,
Sasha Levin <sashal@kernel.org>,
linux-rdma@vger.kernel.org
Subject: [PATCH AUTOSEL 5.3 17/89] RDMA/siw: Fix serialization issue in write_space()
Date: Fri, 18 Oct 2019 18:02:12 -0400 [thread overview]
Message-ID: <20191018220324.8165-17-sashal@kernel.org> (raw)
In-Reply-To: <20191018220324.8165-1-sashal@kernel.org>
From: Krishnamraju Eraparaju <krishna2@chelsio.com>
[ Upstream commit df791c54d627bae53c9be3be40a69594c55de487 ]
In siw_qp_llp_write_space(), 'sock' members should be accessed with
sk_callback_lock held, otherwise, it could race with
siw_sk_restore_upcalls(). And this could cause "NULL deref" panic. Below
panic is due to the NULL cep returned from sk_to_cep(sk):
Call Trace:
<IRQ> siw_qp_llp_write_space+0x11/0x40 [siw]
tcp_check_space+0x4c/0xf0
tcp_rcv_established+0x52b/0x630
tcp_v4_do_rcv+0xf4/0x1e0
tcp_v4_rcv+0x9b8/0xab0
ip_protocol_deliver_rcu+0x2c/0x1c0
ip_local_deliver_finish+0x44/0x50
ip_local_deliver+0x6b/0xf0
? ip_protocol_deliver_rcu+0x1c0/0x1c0
ip_rcv+0x52/0xd0
? ip_rcv_finish_core.isra.14+0x390/0x390
__netif_receive_skb_one_core+0x83/0xa0
netif_receive_skb_internal+0x73/0xb0
napi_gro_frags+0x1ff/0x2b0
t4_ethrx_handler+0x4a7/0x740 [cxgb4]
process_responses+0x2c9/0x590 [cxgb4]
? t4_sge_intr_msix+0x1d/0x30 [cxgb4]
? handle_irq_event_percpu+0x51/0x70
? handle_irq_event+0x41/0x60
? handle_edge_irq+0x97/0x1a0
napi_rx_handler+0x14/0xe0 [cxgb4]
net_rx_action+0x2af/0x410
__do_softirq+0xda/0x2a8
do_softirq_own_stack+0x2a/0x40
</IRQ>
do_softirq+0x50/0x60
__local_bh_enable_ip+0x50/0x60
ip_finish_output2+0x18f/0x520
ip_output+0x6e/0xf0
? __ip_finish_output+0x1f0/0x1f0
__ip_queue_xmit+0x14f/0x3d0
? __slab_alloc+0x4b/0x58
__tcp_transmit_skb+0x57d/0xa60
tcp_write_xmit+0x23b/0xfd0
__tcp_push_pending_frames+0x2e/0xf0
tcp_sendmsg_locked+0x939/0xd50
tcp_sendmsg+0x27/0x40
sock_sendmsg+0x57/0x80
siw_tx_hdt+0x894/0xb20 [siw]
? find_busiest_group+0x3e/0x5b0
? common_interrupt+0xa/0xf
? common_interrupt+0xa/0xf
? common_interrupt+0xa/0xf
siw_qp_sq_process+0xf1/0xe60 [siw]
? __wake_up_common_lock+0x87/0xc0
siw_sq_resume+0x33/0xe0 [siw]
siw_run_sq+0xac/0x190 [siw]
? remove_wait_queue+0x60/0x60
kthread+0xf8/0x130
? siw_sq_resume+0xe0/0xe0 [siw]
? kthread_bind+0x10/0x10
ret_from_fork+0x35/0x40
Fixes: f29dd55b0236 ("rdma/siw: queue pair methods")
Link: https://lore.kernel.org/r/20190923101112.32685-1-krishna2@chelsio.com
Signed-off-by: Krishnamraju Eraparaju <krishna2@chelsio.com>
Reviewed-by: Bernard Metzler <bmt@zurich.ibm.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/sw/siw/siw_qp.c | 15 +++++++++++----
1 file changed, 11 insertions(+), 4 deletions(-)
diff --git a/drivers/infiniband/sw/siw/siw_qp.c b/drivers/infiniband/sw/siw/siw_qp.c
index 430314c8abd94..52d402f39df93 100644
--- a/drivers/infiniband/sw/siw/siw_qp.c
+++ b/drivers/infiniband/sw/siw/siw_qp.c
@@ -182,12 +182,19 @@ void siw_qp_llp_close(struct siw_qp *qp)
*/
void siw_qp_llp_write_space(struct sock *sk)
{
- struct siw_cep *cep = sk_to_cep(sk);
+ struct siw_cep *cep;
- cep->sk_write_space(sk);
+ read_lock(&sk->sk_callback_lock);
+
+ cep = sk_to_cep(sk);
+ if (cep) {
+ cep->sk_write_space(sk);
- if (!test_bit(SOCK_NOSPACE, &sk->sk_socket->flags))
- (void)siw_sq_start(cep->qp);
+ if (!test_bit(SOCK_NOSPACE, &sk->sk_socket->flags))
+ (void)siw_sq_start(cep->qp);
+ }
+
+ read_unlock(&sk->sk_callback_lock);
}
static int siw_qp_readq_init(struct siw_qp *qp, int irq_size, int orq_size)
--
2.20.1
next prev parent reply other threads:[~2019-10-18 22:28 UTC|newest]
Thread overview: 93+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-10-18 22:01 [PATCH AUTOSEL 5.3 01/89] iio: adc: meson_saradc: Fix memory allocation order Sasha Levin
2019-10-18 22:01 ` Sasha Levin
2019-10-18 22:01 ` [PATCH AUTOSEL 5.3 02/89] iio: fix center temperature of bmc150-accel-core Sasha Levin
2019-10-18 22:01 ` [PATCH AUTOSEL 5.3 03/89] libsubcmd: Make _FORTIFY_SOURCE defines dependent on the feature Sasha Levin
2019-10-18 22:01 ` [PATCH AUTOSEL 5.3 04/89] perf tests: Avoid raising SEGV using an obvious NULL dereference Sasha Levin
2019-10-18 22:02 ` [PATCH AUTOSEL 5.3 05/89] perf map: Fix overlapped map handling Sasha Levin
2019-10-18 22:02 ` [PATCH AUTOSEL 5.3 06/89] perf script brstackinsn: Fix recovery from LBR/binary mismatch Sasha Levin
2019-10-18 22:02 ` [PATCH AUTOSEL 5.3 07/89] perf jevents: Fix period for Intel fixed counters Sasha Levin
2019-10-18 22:02 ` [PATCH AUTOSEL 5.3 08/89] perf tools: Propagate get_cpuid() error Sasha Levin
2019-10-18 22:02 ` [PATCH AUTOSEL 5.3 09/89] perf annotate: Propagate perf_env__arch() error Sasha Levin
2019-10-18 22:02 ` [PATCH AUTOSEL 5.3 10/89] perf annotate: Fix the signedness of failure returns Sasha Levin
2019-10-18 22:02 ` [PATCH AUTOSEL 5.3 11/89] perf annotate: Propagate the symbol__annotate() error return Sasha Levin
2019-10-18 22:02 ` [PATCH AUTOSEL 5.3 12/89] perf annotate: Fix arch specific ->init() failure errors Sasha Levin
2019-10-18 22:02 ` [PATCH AUTOSEL 5.3 13/89] perf annotate: Return appropriate error code for allocation failures Sasha Levin
2019-10-18 22:02 ` [PATCH AUTOSEL 5.3 14/89] perf annotate: Don't return -1 for error when doing BPF disassembly Sasha Levin
2019-10-18 22:02 ` [PATCH AUTOSEL 5.3 15/89] staging: rtl8188eu: fix null dereference when kzalloc fails Sasha Levin
2019-10-18 22:02 ` [PATCH AUTOSEL 5.3 16/89] crypto: arm/aes-ce - add dependency on AES library Sasha Levin
2019-10-18 22:02 ` Sasha Levin [this message]
2019-10-18 22:02 ` [PATCH AUTOSEL 5.3 18/89] RDMA/hfi1: Prevent memory leak in sdma_init Sasha Levin
2019-10-18 22:02 ` [PATCH AUTOSEL 5.3 19/89] RDMA/iw_cxgb4: fix SRQ access from dump_qp() Sasha Levin
2019-10-18 22:02 ` [PATCH AUTOSEL 5.3 20/89] RDMA/iwcm: Fix a lock inversion issue Sasha Levin
2019-10-18 22:02 ` [PATCH AUTOSEL 5.3 21/89] HID: hyperv: Use in-place iterator API in the channel callback Sasha Levin
2019-10-18 22:02 ` [PATCH AUTOSEL 5.3 22/89] kselftest: exclude failed TARGETS from runlist Sasha Levin
2019-10-18 22:02 ` [PATCH AUTOSEL 5.3 23/89] selftests/kselftest/runner.sh: Add 45 second timeout per test Sasha Levin
2019-10-18 22:02 ` [PATCH AUTOSEL 5.3 24/89] nfs: Fix nfsi->nrequests count error on nfs_inode_remove_request Sasha Levin
2019-10-18 22:02 ` [PATCH AUTOSEL 5.3 25/89] arm64: cpufeature: Effectively expose FRINT capability to userspace Sasha Levin
2019-10-18 22:02 ` [PATCH AUTOSEL 5.3 26/89] arm64: Fix incorrect irqflag restore for priority masking for compat Sasha Levin
2019-10-18 22:02 ` [PATCH AUTOSEL 5.3 27/89] arm64: ftrace: Ensure synchronisation in PLT setup for Neoverse-N1 #1542419 Sasha Levin
2019-10-18 22:02 ` [PATCH AUTOSEL 5.3 28/89] tty: serial: owl: Fix the link time qualifier of 'owl_uart_exit()' Sasha Levin
2019-10-18 22:02 ` [PATCH AUTOSEL 5.3 29/89] tty: serial: rda: Fix the link time qualifier of 'rda_uart_exit()' Sasha Levin
2019-10-18 22:02 ` [PATCH AUTOSEL 5.3 30/89] serial/sifive: select SERIAL_EARLYCON Sasha Levin
2019-10-18 22:02 ` [PATCH AUTOSEL 5.3 31/89] tty: n_hdlc: fix build on SPARC Sasha Levin
2019-10-18 22:02 ` [PATCH AUTOSEL 5.3 32/89] misc: fastrpc: prevent memory leak in fastrpc_dma_buf_attach Sasha Levin
2019-10-18 22:02 ` [PATCH AUTOSEL 5.3 33/89] RDMA/core: Fix an error handling path in 'res_get_common_doit()' Sasha Levin
2019-10-18 22:02 ` [PATCH AUTOSEL 5.3 34/89] RDMA/cm: Fix memory leak in cm_add/remove_one Sasha Levin
2019-10-18 22:02 ` [PATCH AUTOSEL 5.3 35/89] RDMA/cxgb4: Do not dma memory off of the stack Sasha Levin
2019-10-18 22:02 ` [PATCH AUTOSEL 5.3 36/89] RDMA/nldev: Reshuffle the code to avoid need to rebind QP in error path Sasha Levin
2019-10-18 22:02 ` [PATCH AUTOSEL 5.3 37/89] RDMA/mlx5: Do not allow rereg of a ODP MR Sasha Levin
2019-10-18 22:02 ` [PATCH AUTOSEL 5.3 38/89] RDMA/mlx5: Order num_pending_prefetch properly with synchronize_srcu Sasha Levin
2019-10-18 22:02 ` [PATCH AUTOSEL 5.3 39/89] RDMA/mlx5: Add missing synchronize_srcu() for MW cases Sasha Levin
2019-10-18 22:02 ` [PATCH AUTOSEL 5.3 40/89] gpio: max77620: Use correct unit for debounce times Sasha Levin
2019-10-18 22:02 ` [PATCH AUTOSEL 5.3 41/89] fs: cifs: mute -Wunused-const-variable message Sasha Levin
2019-10-18 22:02 ` [PATCH AUTOSEL 5.3 42/89] arm64: vdso32: Fix broken compat vDSO build warnings Sasha Levin
2019-10-18 22:02 ` [PATCH AUTOSEL 5.3 43/89] arm64: vdso32: Detect binutils support for dmb ishld Sasha Levin
2019-10-18 22:02 ` [PATCH AUTOSEL 5.3 44/89] serial: mctrl_gpio: Check for NULL pointer Sasha Levin
2019-10-18 22:02 ` [PATCH AUTOSEL 5.3 45/89] serial: 8250_omap: Fix gpio check for auto RTS/CTS Sasha Levin
2019-10-18 22:02 ` [PATCH AUTOSEL 5.3 46/89] arm64: Default to building compat vDSO with clang when CONFIG_CC_IS_CLANG Sasha Levin
2019-10-18 22:02 ` [PATCH AUTOSEL 5.3 47/89] arm64: vdso32: Don't use KBUILD_CPPFLAGS unconditionally Sasha Levin
2019-10-18 22:02 ` [PATCH AUTOSEL 5.3 48/89] efi/cper: Fix endianness of PCIe class code Sasha Levin
2019-10-18 22:02 ` [PATCH AUTOSEL 5.3 49/89] efi/x86: Do not clean dummy variable in kexec path Sasha Levin
2019-10-18 22:02 ` [PATCH AUTOSEL 5.3 50/89] kbuild: fix build error of 'make nsdeps' in clean tree Sasha Levin
2019-10-19 0:14 ` Masahiro Yamada
2019-10-29 9:09 ` Sasha Levin
2019-10-18 22:02 ` [PATCH AUTOSEL 5.3 51/89] MIPS: include: Mark __cmpxchg as __always_inline Sasha Levin
2019-10-18 22:02 ` [PATCH AUTOSEL 5.3 52/89] riscv: avoid kernel hangs when trapped in BUG() Sasha Levin
2019-10-18 22:02 ` [PATCH AUTOSEL 5.3 53/89] riscv: avoid sending a SIGTRAP to a user thread trapped in WARN() Sasha Levin
2019-10-18 22:02 ` [PATCH AUTOSEL 5.3 54/89] riscv: Correct the handling of unexpected ebreak in do_trap_break() Sasha Levin
2019-10-18 22:02 ` [PATCH AUTOSEL 5.3 55/89] x86/xen: Return from panic notifier Sasha Levin
2019-10-18 22:02 ` [PATCH AUTOSEL 5.3 56/89] ocfs2: clear zero in unaligned direct IO Sasha Levin
2019-10-18 22:02 ` [PATCH AUTOSEL 5.3 57/89] fs: ocfs2: fix possible null-pointer dereferences in ocfs2_xa_prepare_entry() Sasha Levin
2019-10-18 22:02 ` [PATCH AUTOSEL 5.3 58/89] fs: ocfs2: fix a possible null-pointer dereference in ocfs2_write_end_nolock() Sasha Levin
2019-10-18 22:02 ` [PATCH AUTOSEL 5.3 59/89] fs: ocfs2: fix a possible null-pointer dereference in ocfs2_info_scan_inode_alloc() Sasha Levin
2019-10-18 22:02 ` [PATCH AUTOSEL 5.3 60/89] btrfs: silence maybe-uninitialized warning in clone_range Sasha Levin
2019-10-18 22:02 ` [PATCH AUTOSEL 5.3 61/89] arm64: armv8_deprecated: Checking return value for memory allocation Sasha Levin
2019-10-18 22:02 ` [PATCH AUTOSEL 5.3 62/89] x86/cpu: Add Comet Lake to the Intel CPU models header Sasha Levin
2019-10-18 22:02 ` [PATCH AUTOSEL 5.3 63/89] sched/fair: Scale bandwidth quota and period without losing quota/period ratio precision Sasha Levin
2019-10-18 22:02 ` [PATCH AUTOSEL 5.3 64/89] sched/vtime: Fix guest/system mis-accounting on task switch Sasha Levin
2019-10-18 22:03 ` [PATCH AUTOSEL 5.3 65/89] perf/core: Rework memory accounting in perf_mmap() Sasha Levin
2019-10-18 22:03 ` [PATCH AUTOSEL 5.3 66/89] perf/core: Fix corner case in perf_rotate_context() Sasha Levin
2019-10-18 22:03 ` [PATCH AUTOSEL 5.3 67/89] perf/x86/amd: Change/fix NMI latency mitigation to use a timestamp Sasha Levin
[not found] ` <20191018220324.8165-1-sashal-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org>
2019-10-18 22:03 ` [PATCH AUTOSEL 5.3 68/89] drm/amdgpu: fix memory leak Sasha Levin
2019-10-18 22:03 ` Sasha Levin
2019-10-18 22:03 ` [PATCH AUTOSEL 5.3 69/89] iio: adc: hx711: fix bug in sampling of data Sasha Levin
2019-10-18 22:03 ` [PATCH AUTOSEL 5.3 70/89] iio: accel: adxl372: Fix/remove limitation for FIFO samples Sasha Levin
2019-10-18 22:03 ` [PATCH AUTOSEL 5.3 71/89] iio: accel: adxl372: Fix push to buffers lost samples Sasha Levin
2019-10-18 22:03 ` [PATCH AUTOSEL 5.3 72/89] iio: accel: adxl372: Perform a reset at start up Sasha Levin
2019-10-18 22:03 ` [PATCH AUTOSEL 5.3 73/89] iio: imu: adis16400: release allocated memory on failure Sasha Levin
2019-10-18 22:03 ` [PATCH AUTOSEL 5.3 74/89] iio: imu: adis16400: fix memory leak Sasha Levin
2019-10-18 22:03 ` [PATCH AUTOSEL 5.3 75/89] iio: imu: st_lsm6dsx: fix waitime for st_lsm6dsx i2c controller Sasha Levin
2019-10-18 22:03 ` [PATCH AUTOSEL 5.3 76/89] iio: light: fix vcnl4000 devicetree hooks Sasha Levin
2019-10-18 22:03 ` [PATCH AUTOSEL 5.3 77/89] iio: light: add missing vcnl4040 of_compatible Sasha Levin
2019-10-18 22:03 ` [PATCH AUTOSEL 5.3 78/89] iio: adc: ad799x: fix probe error handling Sasha Levin
2019-10-18 22:03 ` [PATCH AUTOSEL 5.3 79/89] iio: light: opt3001: fix mutex unlock race Sasha Levin
2019-10-18 22:03 ` [PATCH AUTOSEL 5.3 80/89] MIPS: include: Mark __xchg as __always_inline Sasha Levin
2019-10-18 22:03 ` [PATCH AUTOSEL 5.3 81/89] MIPS: fw: sni: Fix out of bounds init of o32 stack Sasha Levin
2019-10-18 22:03 ` [PATCH AUTOSEL 5.3 82/89] s390/cio: fix virtio-ccw DMA without PV Sasha Levin
2019-10-18 22:03 ` [PATCH AUTOSEL 5.3 83/89] USB: usb-skeleton: fix use-after-free after driver unbind Sasha Levin
2019-10-18 22:03 ` [PATCH AUTOSEL 5.3 84/89] virt: vbox: fix memory leak in hgcm_call_preprocess_linaddr Sasha Levin
2019-10-18 22:03 ` [PATCH AUTOSEL 5.3 85/89] nbd: fix possible sysfs duplicate warning Sasha Levin
2019-10-18 22:03 ` [PATCH AUTOSEL 5.3 86/89] NFSv4: Fix leak of clp->cl_acceptor string Sasha Levin
2019-10-18 22:03 ` [PATCH AUTOSEL 5.3 87/89] SUNRPC: fix race to sk_err after xs_error_report Sasha Levin
2019-10-18 22:03 ` [PATCH AUTOSEL 5.3 88/89] s390/uaccess: avoid (false positive) compiler warnings Sasha Levin
2019-10-18 22:03 ` [PATCH AUTOSEL 5.3 89/89] tracing: Initialize iter->seq after zeroing in tracing_read_pipe() Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191018220324.8165-17-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=bmt@zurich.ibm.com \
--cc=jgg@mellanox.com \
--cc=krishna2@chelsio.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-rdma@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.