| Message ID | 20200302181614.17042-1-bmt@zurich.ibm.com (mailing list archive) |
|---|---|
| State | Mainlined |
| Commit | 810dbc69087b08fd53e1cdd6c709f385bc2921ad |
| Delegated to: | Jason Gunthorpe |
| Headers | show |
| Series | [for-rc] RDMA/iwcm: Fix iwcm work deallocation | expand |
On Mon, Mar 02, 2020 at 07:16:14PM +0100, Bernard Metzler wrote: > The dealloc_work_entries() function must update the > work_free_list pointer while freeing its entries, since > potentially called again on same list. A second iteration > of the work list caused system crash. This happens, if > work allocation fails during cma_iw_listen() and > free_cm_id() tries to free the list again during cleanup. > > Reported-by: syzbot+cb0c054eabfba4342146@syzkaller.appspotmail.com > Signed-off-by: Bernard Metzler <bmt@zurich.ibm.com> > --- > drivers/infiniband/core/iwcm.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) Applied to for-rc, please include Fixes lines in patches like this, I added one diff --git a/drivers/infiniband/core/iwcm.c b/drivers/infiniband/core/iwcm.c > index ade71823370f..da8adadf4755 100644 > --- a/drivers/infiniband/core/iwcm.c > +++ b/drivers/infiniband/core/iwcm.c > @@ -159,8 +159,10 @@ static void dealloc_work_entries(struct iwcm_id_private *cm_id_priv) > { > struct list_head *e, *tmp; > > - list_for_each_safe(e, tmp, &cm_id_priv->work_free_list) > + list_for_each_safe(e, tmp, &cm_id_priv->work_free_list) { > + list_del(e); > kfree(list_entry(e, struct iwcm_work, free_list)); It would be nice if someone were to fix the use of the list macros in this file to use the _entry_ versions Jason
diff --git a/drivers/infiniband/core/iwcm.c b/drivers/infiniband/core/iwcm.c index ade71823370f..da8adadf4755 100644 --- a/drivers/infiniband/core/iwcm.c +++ b/drivers/infiniband/core/iwcm.c @@ -159,8 +159,10 @@ static void dealloc_work_entries(struct iwcm_id_private *cm_id_priv) { struct list_head *e, *tmp; - list_for_each_safe(e, tmp, &cm_id_priv->work_free_list) + list_for_each_safe(e, tmp, &cm_id_priv->work_free_list) { + list_del(e); kfree(list_entry(e, struct iwcm_work, free_list)); + } } static int alloc_work_entries(struct iwcm_id_private *cm_id_priv, int count)
The dealloc_work_entries() function must update the work_free_list pointer while freeing its entries, since potentially called again on same list. A second iteration of the work list caused system crash. This happens, if work allocation fails during cma_iw_listen() and free_cm_id() tries to free the list again during cleanup. Reported-by: syzbot+cb0c054eabfba4342146@syzkaller.appspotmail.com Signed-off-by: Bernard Metzler <bmt@zurich.ibm.com> --- drivers/infiniband/core/iwcm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)