From patchwork Wed Jan 17 00:14:06 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bart Van Assche X-Patchwork-Id: 10168321 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 2A49B600CA for ; Wed, 17 Jan 2018 00:14:26 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 201DF26E47 for ; Wed, 17 Jan 2018 00:14:26 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 14B5227528; Wed, 17 Jan 2018 00:14:26 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_HI,T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 9E96626E47 for ; Wed, 17 Jan 2018 00:14:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751760AbeAQAOX (ORCPT ); Tue, 16 Jan 2018 19:14:23 -0500 Received: from esa2.hgst.iphmx.com ([68.232.143.124]:58110 "EHLO esa2.hgst.iphmx.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750846AbeAQAOV (ORCPT ); Tue, 16 Jan 2018 19:14:21 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=wdc.com; i=@wdc.com; q=dns/txt; s=dkim.wdc.com; t=1516149129; x=1547685129; h=from:to:cc:subject:date:message-id:in-reply-to: references; bh=Ove3m/1l1Oda+2mxExdG31VVX7XxUZrCnvZJcevRdRw=; b=cUVL0XfQ0TAEVYakHAd7yTSZliW+pspgBzA6o26ruO2ReEagjz+HoxSg ek15K6HyhKyQ8YKPuahoQGSgue2AUWHNbaMAyLaYAj+qPNzVha1eS4AcH iQdkB/3b92YIgFBtStw9cV8xTr+E3b1/fUqE+HRUHGOLWjQ2KJLJ4jW8g VdXndabsI8kUdXrg5j6m4ZdpMng5e70znE2S6VDInn1h4j6bBZniCbTik WlihPr7GOnfFCXrDjBqWFc9H1gQCA6HCrYdnAvx0S00EYhoBnJi7ANoZJ JCW7UwbczNNs8nrpXKVLnE3J0UZhjndn4ikabdBvr9Dg7S7E5CqhiPh7L Q==; X-IronPort-AV: E=Sophos;i="5.46,369,1511798400"; d="scan'208";a="165530445" Received: from h199-255-45-15.hgst.com (HELO uls-op-cesaep02.wdc.com) ([199.255.45.15]) by ob1.hgst.iphmx.com with ESMTP; 17 Jan 2018 08:32:07 +0800 Received: from uls-op-cesaip01.wdc.com ([10.248.3.36]) by uls-op-cesaep02.wdc.com with ESMTP; 16 Jan 2018 16:09:34 -0800 Received: from thinkpad-bart.sdcorp.global.sandisk.com (HELO thinkpad-bart.int.fusionio.com) ([10.11.171.236]) by uls-op-cesaip01.wdc.com with ESMTP; 16 Jan 2018 16:14:19 -0800 From: Bart Van Assche To: Jason Gunthorpe Cc: Doug Ledford , linux-rdma@vger.kernel.org, Bart Van Assche Subject: [PATCH v2 02/14] IB/srpt: Rework srpt_disconnect_ch_sync() Date: Tue, 16 Jan 2018 16:14:06 -0800 Message-Id: <20180117001418.7852-3-bart.vanassche@wdc.com> X-Mailer: git-send-email 2.15.1 In-Reply-To: <20180117001418.7852-1-bart.vanassche@wdc.com> References: <20180117001418.7852-1-bart.vanassche@wdc.com> Sender: linux-rdma-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-rdma@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP This patch fixes a use-after-free issue for ch->release_done when running the SRP protocol on top of the rdma_rxe driver. Signed-off-by: Bart Van Assche --- drivers/infiniband/ulp/srpt/ib_srpt.c | 45 ++++++++++++++++++----------------- drivers/infiniband/ulp/srpt/ib_srpt.h | 2 -- 2 files changed, 23 insertions(+), 24 deletions(-) diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c index 4dd15378bc7c..5386b993daf9 100644 --- a/drivers/infiniband/ulp/srpt/ib_srpt.c +++ b/drivers/infiniband/ulp/srpt/ib_srpt.c @@ -1841,6 +1841,23 @@ static int srpt_disconnect_ch(struct srpt_rdma_ch *ch) return ret; } +static bool srpt_ch_closed(struct srpt_device *sdev, struct srpt_rdma_ch *ch) +{ + struct srpt_rdma_ch *ch2; + bool res = true; + + rcu_read_lock(); + list_for_each_entry(ch2, &sdev->rch_list, list) { + if (ch2 == ch) { + res = false; + break; + } + } + rcu_read_unlock(); + + return res; +} + /* * Send DREQ and wait for DREP. Return true if and only if this function * changed the state of @ch. @@ -1848,31 +1865,24 @@ static int srpt_disconnect_ch(struct srpt_rdma_ch *ch) static bool srpt_disconnect_ch_sync(struct srpt_rdma_ch *ch) __must_hold(&sdev->mutex) { - DECLARE_COMPLETION_ONSTACK(release_done); struct srpt_device *sdev = ch->sport->sdev; - bool wait; + int ret; lockdep_assert_held(&sdev->mutex); pr_debug("ch %s-%d state %d\n", ch->sess_name, ch->qp->qp_num, ch->state); - WARN_ON(ch->release_done); - ch->release_done = &release_done; - wait = !list_empty(&ch->list); - srpt_disconnect_ch(ch); + ret = srpt_disconnect_ch(ch); mutex_unlock(&sdev->mutex); - if (!wait) - goto out; - - while (wait_for_completion_timeout(&release_done, 180 * HZ) == 0) + while (wait_event_timeout(sdev->ch_releaseQ, srpt_ch_closed(sdev, ch), + 5 * HZ) == 0) pr_info("%s(%s-%d state %d): still waiting ...\n", __func__, ch->sess_name, ch->qp->qp_num, ch->state); -out: mutex_lock(&sdev->mutex); - return wait; + return ret == 0; } static void srpt_set_enabled(struct srpt_port *sport, bool enabled) @@ -1916,8 +1926,7 @@ static void srpt_release_channel_work(struct work_struct *w) struct se_session *se_sess; ch = container_of(w, struct srpt_rdma_ch, release_work); - pr_debug("%s: %s-%d; release_done = %p\n", __func__, ch->sess_name, - ch->qp->qp_num, ch->release_done); + pr_debug("%s-%d\n", ch->sess_name, ch->qp->qp_num); sdev = ch->sport->sdev; BUG_ON(!sdev); @@ -1946,14 +1955,6 @@ static void srpt_release_channel_work(struct work_struct *w) mutex_lock(&sdev->mutex); list_del_rcu(&ch->list); - if (ch->release_done) - complete(ch->release_done); - mutex_unlock(&sdev->mutex); - - synchronize_rcu(); - - mutex_lock(&sdev->mutex); - INIT_LIST_HEAD(&ch->list); mutex_unlock(&sdev->mutex); wake_up(&sdev->ch_releaseQ); diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.h b/drivers/infiniband/ulp/srpt/ib_srpt.h index 0ab59c60f2ef..67248338b4c9 100644 --- a/drivers/infiniband/ulp/srpt/ib_srpt.h +++ b/drivers/infiniband/ulp/srpt/ib_srpt.h @@ -270,7 +270,6 @@ enum rdma_ch_state { * @sess_name: Session name. * @ini_guid: Initiator port GUID. * @release_work: Allows scheduling of srpt_release_channel(). - * @release_done: Enables waiting for srpt_release_channel() completion. */ struct srpt_rdma_ch { struct ib_cm_id *cm_id; @@ -299,7 +298,6 @@ struct srpt_rdma_ch { u8 sess_name[36]; u8 ini_guid[24]; struct work_struct release_work; - struct completion *release_done; }; /**