Re: qib_lookup_qpn() appears to leak pointer out of rcu_read_unlock()

["Paul E. McKenney" <paulmck-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8@public.gmane.org>]

On Wed, Feb 12, 2014 at 02:57:14PM +0000, Marciniszyn, Mike wrote:
> BTW, I am considering eliminating the atomic_inc() in favor of widening the scope of the rcu lock expanse.

As long as the newly included code doesn't block, that should work fine.
(If it does block, another option is SRCU.)

							Thanx, Paul

> Mike
> 
> > -----Original Message-----
> > From: Paul E. McKenney [mailto:paulmck-23VcF4HTsmIX0ybBhKVfKdBPR1lH4CV8@public.gmane.org]
> > Sent: Wednesday, February 12, 2014 9:56 AM
> > To: Marciniszyn, Mike
> > Cc: roland-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org; Hefty, Sean; hal.rosenstock-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org; linux-
> > rdma-u79uwXL29TY76Z2rM5mHXA@public.gmane.org; linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
> > Subject: Re: qib_lookup_qpn() appears to leak pointer out of rcu_read_unlock()
> > 
> > On Wed, Feb 12, 2014 at 01:59:30PM +0000, Marciniszyn, Mike wrote:
> > > > So what am I missing here?
> > > >
> > >
> > > The atomic increment of a reference count:
> > 
> > Got it, thank you, apologies for the noise!
> > 
> > 							Thanx, Paul
> > 
> > > struct qib_qp *qib_lookup_qpn(struct qib_ibport *ibp, u32 qpn) {
> > >         struct qib_qp *qp = NULL;
> > >
> > >         rcu_read_lock();
> > >         if (unlikely(qpn <= 1)) {
> > >                 if (qpn == 0)
> > >                         qp = rcu_dereference(ibp->qp0);
> > >                 else
> > >                         qp = rcu_dereference(ibp->qp1);
> > >                 if (qp)
> > >                         atomic_inc(&qp->refcount); <--------------------------
> > >         } else {
> > >                 struct qib_ibdev *dev = &ppd_from_ibp(ibp)->dd->verbs_dev;
> > >                 unsigned n = qpn_hash(dev, qpn);
> > >
> > >                 for (qp = rcu_dereference(dev->qp_table[n]); qp;
> > >                         qp = rcu_dereference(qp->next))
> > >                         if (qp->ibqp.qp_num == qpn) {
> > >                                 atomic_inc(&qp->refcount); <---------------------
> > >                                 break;
> > >                         }
> > >         }
> > >         rcu_read_unlock();
> > >         return qp;
> > > }
> > >
> > > Mike
> > >
> 

--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html