From patchwork Tue Nov 14 16:43:47 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Michael J. Ruhl" X-Patchwork-Id: 10057893 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id EE2BA60231 for ; Tue, 14 Nov 2017 16:43:50 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id DF2F5297DF for ; Tue, 14 Nov 2017 16:43:50 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id D428229862; Tue, 14 Nov 2017 16:43:50 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 4F3932982F for ; Tue, 14 Nov 2017 16:43:50 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755112AbdKNQnt (ORCPT ); Tue, 14 Nov 2017 11:43:49 -0500 Received: from mga07.intel.com ([134.134.136.100]:8083 "EHLO mga07.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754995AbdKNQnt (ORCPT ); Tue, 14 Nov 2017 11:43:49 -0500 Received: from orsmga001.jf.intel.com ([10.7.209.18]) by orsmga105.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 14 Nov 2017 08:43:48 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.44,395,1505804400"; d="scan'208";a="4861793" Received: from sedona.ch.intel.com ([143.182.228.65]) by orsmga001.jf.intel.com with ESMTP; 14 Nov 2017 08:43:48 -0800 Received: from phlsvsles11.ph.intel.com (phlsvsles11.ph.intel.com [10.228.195.43]) by sedona.ch.intel.com (8.13.6/8.14.3/Standard MailSET/Hub) with ESMTP id vAEGhlr8014348 for ; Tue, 14 Nov 2017 09:43:48 -0700 Received: from phlsvslse11.ph.intel.com (localhost [127.0.0.1]) by phlsvsles11.ph.intel.com with ESMTP id vAEGhlkL024682 for ; Tue, 14 Nov 2017 11:43:47 -0500 Subject: [PATCH v3 3/4] ibacm: Fix a retry loop calculation race condition To: linux-rdma@vger.kernel.org From: "Michael J. Ruhl" Date: Tue, 14 Nov 2017 11:43:47 -0500 Message-ID: <20171114164337.24557.45231.stgit@phlsvslse11.ph.intel.com> In-Reply-To: <20171114164006.24557.72093.stgit@phlsvslse11.ph.intel.com> References: <20171114164006.24557.72093.stgit@phlsvslse11.ph.intel.com> User-Agent: StGit/0.16 MIME-Version: 1.0 Sender: linux-rdma-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-rdma@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Michael J. Ruhl The retry loop calculation uses a conversion to int of an unsigned 64 bit number (next_expire) minus the current time to decide if event_wait() should be called. This calculation works correctly as long as the next_expire value is not the default value (-1). If the next_expire is the default value, periodically this subtraction can result in a very large postive timeout value (days rather than milliseconds). For example: next_expire = 0xFFFFFFFFFFFFFFFF (-1) current_ms = 0x15f7db52146 (today's ms since 1970) max_delay_ms = (int) next_expire - future_ms future_ms = 0x15f80000000 = max_delay_ms 2147483647 future_ms = 0x16080000000 = max_delay_ms 2147483647 Converting max_delay_ms to days: 2147483647 / 1000 / 60 / 60 / 24 == 24 days 0xxx180000000 - 0xxx080000000 = 4294967296 every 48 days, this issue repeats This calculation can occur if a wait_cnt is incremented and a message expiration is handled so that next_expire is not updated. If wait_cnt is incremented before the wait calculation is done (the race condition), event_wait() can be called with the potentially very large value. If next_expire is not updated, do not do the wait calculation and avoid the race condition. Reported-by: Morys Grzegorz Reviewed-by: Mike Marciniszyn Reviewed-by: Dennis Dalessandro Signed-off-by: Michael J. Ruhl --- ibacm/prov/acmp/src/acmp.c | 10 ++++++---- 1 files changed, 6 insertions(+), 4 deletions(-) -- To unsubscribe from this list: send the line "unsubscribe linux-rdma" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/ibacm/prov/acmp/src/acmp.c b/ibacm/prov/acmp/src/acmp.c index d707b8e..884fc48 100644 --- a/ibacm/prov/acmp/src/acmp.c +++ b/ibacm/prov/acmp/src/acmp.c @@ -1579,10 +1579,12 @@ static void *acmp_retry_handler(void *context) pthread_mutex_unlock(&acmp_dev_lock); acmp_process_timeouts(); - wait = (int) (next_expire - time_stamp_ms()); - if (wait > 0 && atomic_get(&wait_cnt)) { - pthread_testcancel(); - event_wait(&timeout_event, wait); + if (next_expire != -1) { + wait = (int) (next_expire - time_stamp_ms()); + if (wait > 0 && atomic_get(&wait_cnt)) { + pthread_testcancel(); + event_wait(&timeout_event, wait); + } } }