From: Jason Gunthorpe <jgg@mellanox.com>
To: "Håkon Bugge" <haakon.bugge@oracle.com>
Cc: Doug Ledford <dledford@redhat.com>,
OFED mailing list <linux-rdma@vger.kernel.org>,
george kennedy <george.kennedy@oracle.com>
Subject: Re: [PATCH for-rc] RDMA/cma: fix race between addr_handler and resolve_route
Date: Thu, 16 Apr 2020 15:55:22 -0300 [thread overview]
Message-ID: <20200416185522.GA11945@mellanox.com> (raw)
In-Reply-To: <3168883E-169E-4D96-A4F5-8FF882B164BC@oracle.com>
On Thu, Apr 16, 2020 at 03:33:28PM +0200, Håkon Bugge wrote:
> > I think the trick is that ucma_event_handler never returns failure
> > unless RDMA_CM_EVENT_CONNECT_REQUEST, which means the cm_id isn't in
> > the xarray yet?
>
> Sure does. 1 or -ENOMEM. But the ULP's event handlers isn't that
> polite. But a different issue from this syzkaller one.
Seems like a crazy and difficult API to me..
> >> I assume the refcounting takes care of this.
> >
> > There is no refcounting for destroy, it must be called once.
>
> I was thinking about the "cma_deref_id(id_priv);" stuff, but I may have misunderstood.
This just causes destroy_id to pause while a ref is held, there can
still be only one call to destroy_id
Jason
next prev parent reply other threads:[~2020-04-16 18:55 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-04-03 18:43 [PATCH for-rc] RDMA/cma: fix race between addr_handler and resolve_route Håkon Bugge
2020-04-03 18:57 ` Jason Gunthorpe
2020-04-03 19:07 ` Håkon Bugge
2020-04-03 19:36 ` Jason Gunthorpe
2020-04-06 17:00 ` Håkon Bugge
2020-04-06 17:31 ` Jason Gunthorpe
2020-04-06 18:02 ` Håkon Bugge
2020-04-06 18:10 ` Jason Gunthorpe
2020-04-14 10:34 ` Håkon Bugge
2020-04-14 12:50 ` Jason Gunthorpe
2020-04-14 13:57 ` Håkon Bugge
2020-04-14 16:11 ` Jason Gunthorpe
2020-04-16 13:33 ` Håkon Bugge
2020-04-16 18:55 ` Jason Gunthorpe [this message]
2021-04-28 6:03 ` general protection fault in rdma_resolve_route syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200416185522.GA11945@mellanox.com \
--to=jgg@mellanox.com \
--cc=dledford@redhat.com \
--cc=george.kennedy@oracle.com \
--cc=haakon.bugge@oracle.com \
--cc=linux-rdma@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.