* [PATCH] xrpcrdma: add missing error checks in rpcrdma_ep_destroy
@ 2022-01-25 19:17 Dan Aloni
2022-01-25 19:30 ` Chuck Lever III
0 siblings, 1 reply; 5+ messages in thread
From: Dan Aloni @ 2022-01-25 19:17 UTC (permalink / raw)
To: chuck.lever; +Cc: linux-nfs
These pointers can be non-NULL and contain errors if initialization is
aborted early. This is similar to how `__svc_rdma_free` takes care of
it.
Signed-off-by: Dan Aloni <dan.aloni@vastdata.com>
---
net/sunrpc/xprtrdma/verbs.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
index f172d1298013..7f3173073e72 100644
--- a/net/sunrpc/xprtrdma/verbs.c
+++ b/net/sunrpc/xprtrdma/verbs.c
@@ -336,14 +336,14 @@ static void rpcrdma_ep_destroy(struct kref *kref)
ep->re_id->qp = NULL;
}
- if (ep->re_attr.recv_cq)
+ if (ep->re_attr.recv_cq && !IS_ERR(ep->re_attr.recv_cq))
ib_free_cq(ep->re_attr.recv_cq);
ep->re_attr.recv_cq = NULL;
- if (ep->re_attr.send_cq)
+ if (ep->re_attr.send_cq && !IS_ERR(ep->re_attr.send_cq))
ib_free_cq(ep->re_attr.send_cq);
ep->re_attr.send_cq = NULL;
- if (ep->re_pd)
+ if (ep->re_pd && !IS_ERR(ep->re_pd))
ib_dealloc_pd(ep->re_pd);
ep->re_pd = NULL;
--
2.23.0
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH] xrpcrdma: add missing error checks in rpcrdma_ep_destroy
2022-01-25 19:17 [PATCH] xrpcrdma: add missing error checks in rpcrdma_ep_destroy Dan Aloni
@ 2022-01-25 19:30 ` Chuck Lever III
2022-01-25 19:46 ` Dan Aloni
2022-01-25 20:06 ` [PATCH] xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create Dan Aloni
0 siblings, 2 replies; 5+ messages in thread
From: Chuck Lever III @ 2022-01-25 19:30 UTC (permalink / raw)
To: Dan Aloni; +Cc: Linux NFS Mailing List
> On Jan 25, 2022, at 2:17 PM, Dan Aloni <dan.aloni@vastdata.com> wrote:
>
> These pointers can be non-NULL and contain errors if initialization is
> aborted early. This is similar to how `__svc_rdma_free` takes care of
> it.
IIUC the only place that can set these values to an
ERR_PTR is rpcrdma_ep_create() ? I think I'd rather
have rpcrdma_ep_create() set the fields to NULL in
the error cases.
Good catch. I'm afraid to ask how you found this.
> Signed-off-by: Dan Aloni <dan.aloni@vastdata.com>
> ---
> net/sunrpc/xprtrdma/verbs.c | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
> index f172d1298013..7f3173073e72 100644
> --- a/net/sunrpc/xprtrdma/verbs.c
> +++ b/net/sunrpc/xprtrdma/verbs.c
> @@ -336,14 +336,14 @@ static void rpcrdma_ep_destroy(struct kref *kref)
> ep->re_id->qp = NULL;
> }
>
> - if (ep->re_attr.recv_cq)
> + if (ep->re_attr.recv_cq && !IS_ERR(ep->re_attr.recv_cq))
> ib_free_cq(ep->re_attr.recv_cq);
> ep->re_attr.recv_cq = NULL;
> - if (ep->re_attr.send_cq)
> + if (ep->re_attr.send_cq && !IS_ERR(ep->re_attr.send_cq))
> ib_free_cq(ep->re_attr.send_cq);
> ep->re_attr.send_cq = NULL;
>
> - if (ep->re_pd)
> + if (ep->re_pd && !IS_ERR(ep->re_pd))
> ib_dealloc_pd(ep->re_pd);
> ep->re_pd = NULL;
>
> --
> 2.23.0
>
--
Chuck Lever
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] xrpcrdma: add missing error checks in rpcrdma_ep_destroy
2022-01-25 19:30 ` Chuck Lever III
@ 2022-01-25 19:46 ` Dan Aloni
2022-01-25 20:06 ` [PATCH] xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create Dan Aloni
1 sibling, 0 replies; 5+ messages in thread
From: Dan Aloni @ 2022-01-25 19:46 UTC (permalink / raw)
To: Chuck Lever III; +Cc: Linux NFS Mailing List
On Tue, Jan 25, 2022 at 07:30:05PM +0000, Chuck Lever III wrote:
>
>
> > On Jan 25, 2022, at 2:17 PM, Dan Aloni <dan.aloni@vastdata.com> wrote:
> >
> > These pointers can be non-NULL and contain errors if initialization is
> > aborted early. This is similar to how `__svc_rdma_free` takes care of
> > it.
>
> IIUC the only place that can set these values to an
> ERR_PTR is rpcrdma_ep_create() ? I think I'd rather
> have rpcrdma_ep_create() set the fields to NULL in
> the error cases.
Actually that was my initialization draft but then I saw
`__svc_rdma_free`. Will send over.
> Good catch. I'm afraid to ask how you found this.
Just some adapter entering error state in firmware.
--
Dan Aloni
^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH] xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create
2022-01-25 19:30 ` Chuck Lever III
2022-01-25 19:46 ` Dan Aloni
@ 2022-01-25 20:06 ` Dan Aloni
2022-01-25 20:08 ` Chuck Lever III
1 sibling, 1 reply; 5+ messages in thread
From: Dan Aloni @ 2022-01-25 20:06 UTC (permalink / raw)
To: chuck.lever; +Cc: linux-nfs
If there are failures then we must not leave the non-NULL pointers with
the error value, otherwise `rpcrdma_ep_destroy` gets confused and tries
free them, resulting in an Oops.
Signed-off-by: Dan Aloni <dan.aloni@vastdata.com>
---
net/sunrpc/xprtrdma/verbs.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
index 3d3673ba9e1e..2a2e1514ac79 100644
--- a/net/sunrpc/xprtrdma/verbs.c
+++ b/net/sunrpc/xprtrdma/verbs.c
@@ -436,6 +436,7 @@ static int rpcrdma_ep_create(struct rpcrdma_xprt *r_xprt)
IB_POLL_WORKQUEUE);
if (IS_ERR(ep->re_attr.send_cq)) {
rc = PTR_ERR(ep->re_attr.send_cq);
+ ep->re_attr.send_cq = NULL;
goto out_destroy;
}
@@ -444,6 +445,7 @@ static int rpcrdma_ep_create(struct rpcrdma_xprt *r_xprt)
IB_POLL_WORKQUEUE);
if (IS_ERR(ep->re_attr.recv_cq)) {
rc = PTR_ERR(ep->re_attr.recv_cq);
+ ep->re_attr.recv_cq = NULL;
goto out_destroy;
}
ep->re_receive_count = 0;
@@ -482,6 +484,7 @@ static int rpcrdma_ep_create(struct rpcrdma_xprt *r_xprt)
ep->re_pd = ib_alloc_pd(device, 0);
if (IS_ERR(ep->re_pd)) {
rc = PTR_ERR(ep->re_pd);
+ ep->re_pd = NULL;
goto out_destroy;
}
--
2.23.0
^ permalink raw reply related [flat|nested] 5+ messages in thread* Re: [PATCH] xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create
2022-01-25 20:06 ` [PATCH] xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create Dan Aloni
@ 2022-01-25 20:08 ` Chuck Lever III
0 siblings, 0 replies; 5+ messages in thread
From: Chuck Lever III @ 2022-01-25 20:08 UTC (permalink / raw)
To: Anna Schumaker; +Cc: Linux NFS Mailing List, Dan Aloni
Hi Anna-
> On Jan 25, 2022, at 3:06 PM, Dan Aloni <dan.aloni@vastdata.com> wrote:
>
> If there are failures then we must not leave the non-NULL pointers with
> the error value, otherwise `rpcrdma_ep_destroy` gets confused and tries
> free them, resulting in an Oops.
>
> Signed-off-by: Dan Aloni <dan.aloni@vastdata.com>
Acked-by: Chuck Lever <chuck.lever@oracle.com>
> ---
> net/sunrpc/xprtrdma/verbs.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
> index 3d3673ba9e1e..2a2e1514ac79 100644
> --- a/net/sunrpc/xprtrdma/verbs.c
> +++ b/net/sunrpc/xprtrdma/verbs.c
> @@ -436,6 +436,7 @@ static int rpcrdma_ep_create(struct rpcrdma_xprt *r_xprt)
> IB_POLL_WORKQUEUE);
> if (IS_ERR(ep->re_attr.send_cq)) {
> rc = PTR_ERR(ep->re_attr.send_cq);
> + ep->re_attr.send_cq = NULL;
> goto out_destroy;
> }
>
> @@ -444,6 +445,7 @@ static int rpcrdma_ep_create(struct rpcrdma_xprt *r_xprt)
> IB_POLL_WORKQUEUE);
> if (IS_ERR(ep->re_attr.recv_cq)) {
> rc = PTR_ERR(ep->re_attr.recv_cq);
> + ep->re_attr.recv_cq = NULL;
> goto out_destroy;
> }
> ep->re_receive_count = 0;
> @@ -482,6 +484,7 @@ static int rpcrdma_ep_create(struct rpcrdma_xprt *r_xprt)
> ep->re_pd = ib_alloc_pd(device, 0);
> if (IS_ERR(ep->re_pd)) {
> rc = PTR_ERR(ep->re_pd);
> + ep->re_pd = NULL;
> goto out_destroy;
> }
>
> --
> 2.23.0
>
--
Chuck Lever
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2022-01-25 20:08 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2022-01-25 19:17 [PATCH] xrpcrdma: add missing error checks in rpcrdma_ep_destroy Dan Aloni
2022-01-25 19:30 ` Chuck Lever III
2022-01-25 19:46 ` Dan Aloni
2022-01-25 20:06 ` [PATCH] xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create Dan Aloni
2022-01-25 20:08 ` Chuck Lever III
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.