diff options
author | Andrew Boyer <andrew.boyer@dell.com> | 2017-08-28 16:11:50 -0400 |
---|---|---|
committer | Doug Ledford <dledford@redhat.com> | 2017-08-28 19:12:32 -0400 |
commit | bfc3ae05660e928b34034e668a82c334111c0c22 (patch) | |
tree | 231d67fbfd0340d13beeb204e7c30cc452ef8a00 /drivers/infiniband/sw/rxe/rxe_verbs.h | |
parent | 9eb7f8e44d13cd2a565a5f088c8a842810270757 (diff) | |
download | linux-bfc3ae05660e928b34034e668a82c334111c0c22.tar.bz2 |
IB/rxe: Disable completion upcalls when a CQ is destroyed
This prevents the stack from accessing userspace objects while they
are being torn down.
One possible sequence of events:
- Userspace program exits
- ib_uverbs_cleanup_ucontext() runs, calling ib_destroy_qp(),
ib_destroy_cq(), etc. and releasing/freeing the UCQ
- The QP still has tasklets running, so it isn't destroyed yet
- The CQ is referenced by the QP, so the CQ isn't destroyed yet
- The UCQ is kfree()'d anyway
- A send work request completes
- rxe_send_complete() calls cq->ibcq.comp_handler()
- ib_uverbs_comp_handler() runs and crashes; the event queue is checked
for is_closed, but it has no way to check the ib_ucq_object before
accessing it
The reference counting on the CQ doesn't protect against this since the CQ
hasn't been destroyed yet.
There's no available interface to deregister the UCQ from the CQ, and it
didn't appear that attempting to add reference counting to the UCQ was
going to be a good way to go since this solution is much simpler.
Fixes: 8700e3e7c485 ("Soft RoCE driver")
Signed-off-by: Andrew Boyer <andrew.boyer@dell.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Diffstat (limited to 'drivers/infiniband/sw/rxe/rxe_verbs.h')
-rw-r--r-- | drivers/infiniband/sw/rxe/rxe_verbs.h | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.h b/drivers/infiniband/sw/rxe/rxe_verbs.h index 5a180fbe40d9..b09a9e26ca73 100644 --- a/drivers/infiniband/sw/rxe/rxe_verbs.h +++ b/drivers/infiniband/sw/rxe/rxe_verbs.h @@ -89,6 +89,7 @@ struct rxe_cq { struct rxe_queue *queue; spinlock_t cq_lock; u8 notify; + bool is_dying; int is_user; struct tasklet_struct comp_task; }; |