summaryrefslogtreecommitdiffstats
path: root/lib/idr.c
diff options
context:
space:
mode:
authorShay Drory <shayd@mellanox.com>2020-06-21 13:47:35 +0300
committerJason Gunthorpe <jgg@nvidia.com>2020-06-22 14:57:44 -0300
commit116a1b9f1cb769b83e5adff323f977a62b1dcb2e (patch)
tree240f19fc8e9dc30e5ba24d508ba8adfa79c1cdf3 /lib/idr.c
parent6eefa839c4dddf2149e9f5f6f1aa3e1191c8db9c (diff)
downloadlinux-116a1b9f1cb769b83e5adff323f977a62b1dcb2e.tar.bz2
IB/mad: Fix use after free when destroying MAD agent
Currently, when RMPP MADs are processed while the MAD agent is destroyed, it could result in use after free of rmpp_recv, as decribed below: cpu-0 cpu-1 ----- ----- ib_mad_recv_done() ib_mad_complete_recv() ib_process_rmpp_recv_wc() unregister_mad_agent() ib_cancel_rmpp_recvs() cancel_delayed_work() process_rmpp_data() start_rmpp() queue_delayed_work(rmpp_recv->cleanup_work) destroy_rmpp_recv() free_rmpp_recv() cleanup_work()[1] spin_lock_irqsave(&rmpp_recv->agent->lock) <-- use after free [1] cleanup_work() == recv_cleanup_handler Fix it by waiting for the MAD agent reference count becoming zero before calling to ib_cancel_rmpp_recvs(). Fixes: 9a41e38a467c ("IB/mad: Use IDR for agent IDs") Link: https://lore.kernel.org/r/20200621104738.54850-2-leon@kernel.org Signed-off-by: Shay Drory <shayd@mellanox.com> Reviewed-by: Maor Gottlieb <maorg@mellanox.com> Signed-off-by: Leon Romanovsky <leonro@mellanox.com> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Diffstat (limited to 'lib/idr.c')
0 files changed, 0 insertions, 0 deletions