From patchwork Mon May 12 08:31:13 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Bart Van Assche X-Patchwork-Id: 4157001 Return-Path: X-Original-To: patchwork-linux-rdma@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.19.201]) by patchwork2.web.kernel.org (Postfix) with ESMTP id 35E30BFF02 for ; Mon, 12 May 2014 09:09:29 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 415FA20260 for ; Mon, 12 May 2014 09:09:28 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 1B8E22022D for ; Mon, 12 May 2014 09:09:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752464AbaELJJ0 (ORCPT ); Mon, 12 May 2014 05:09:26 -0400 Received: from sf1.bxl.stone.is ([87.238.167.36]:51607 "EHLO sf1.bxl.stone.is" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751015AbaELJJZ (ORCPT ); Mon, 12 May 2014 05:09:25 -0400 Received: from smtp03.stone-is.org ([87.238.162.6] helo=smtpgw.stone-is.be) by sf1.bxl.stone.is with esmtp (Exim 4.82) (envelope-from ) id 1Wjldt-0004S5-RC; Mon, 12 May 2014 10:31:26 +0200 Received: from localhost (unknown [127.0.0.1]) by smtpgw.stone-is.be (Postfix) with ESMTP id EBD103D9D07; Mon, 12 May 2014 08:31:15 +0000 (UTC) Received: from smtpgw.stone-is.be ([127.0.0.1]) by localhost (smtpgw.stone-is.be [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mj70A4LUeBbZ; Mon, 12 May 2014 10:31:14 +0200 (CEST) Received: from vz19.stone-is.net (vz19.stone-is.net [87.238.162.57]) by smtpgw.stone-is.be (Postfix) with ESMTP id 375C7334C96; Mon, 12 May 2014 10:31:14 +0200 (CEST) X-No-Relay: not in my network X-No-Relay: not in my network X-No-Relay: not in my network Received: from [192.168.1.117] (178-119-65-67.access.telenet.be [178.119.65.67]) by vz19.stone-is.net (Postfix) with ESMTPSA id F339B88D6A; Mon, 12 May 2014 10:31:13 +0200 (CEST) Message-ID: <537086D1.8010209@acm.org> Date: Mon, 12 May 2014 10:31:13 +0200 From: Bart Van Assche User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:24.0) Gecko/20100101 Thunderbird/24.4.0 MIME-Version: 1.0 To: Roland Dreier CC: Alex Chiang , linux-rdma Subject: [PATCH 3/3] IB/umad: Fix a use-after-free References: <53708666.6060209@acm.org> In-Reply-To: <53708666.6060209@acm.org> X-Enigmail-Version: 1.6 X-Filter-ID: XtLePq6GTMn8G68F0EmQvdthj6rk7ohlAkaRQG+cDaLZlN3ufQ0ZRHdy43341LQ0JYRGiu4wDuX/ sGw1Y7RAsb1SR70Wkof6QMErSa5awdkG42j8At+vc1CnB5mb3BSJepitAFwwEbMGYUpxADAT6yBk 0ydfoHV3ZNUPsk+Z52roCkoJ9G4OvGb2HIs11FkfMlUS0dQK1WpVL+8woncDCCzeB9pvwUdZop4W TqB/IDI9L+b1FUH9rtRc7ZmdYdr8ZuM7jUXIESohoO51xWmU8RJAVQYcOmAyRxcS32YydgD3I84v mkP3oh+YQqB4J59UsV2kVJ6iI4C9lEspssReek9NT0wnz2h8ADwycfME7g7Q08vWrPDgMXSp0PD/ +0YjOyzxI2kbjN9NHAai2rh92SivUpI7xYBewOHb5FYgdqqjrcITHcksS7joBcHFiJvPoXKxVxxs Ub1NautSP08O+Rz9D+/9oSt5jUrIaWXjdPREcrtd1OJc8clu1cTxQ0e5UzNQey813JRaAeaBSS7l 0j3WJzM9TQ2QEdWAURl0Sg657IUNtZsmYlZe2TrEPH/I5Djdh90lkiY12gKagMfROw6LUO0JT1q/ AWrYG3aFTnrY3JzFJCHR3HpTyYBZpumpLMyO3ZTuK9Swav1ZU5rUoxgD/FVEY7v4laIdTJ8d+KD7 wgeRkzvLcTEd6PfP2bk7MS+4ayUpOtEhdxekWDmK9g== X-Report-Abuse-To: spam@sf1.bxl.stone.is X-Originating-IP: 87.238.162.6 X-SpamExperts-Domain: stone.is X-SpamExperts-Username: 87.238.162.6 Authentication-Results: bxl.stone.is; auth=pass smtp.auth=87.238.162.6 X-SpamExperts-Outgoing-Class: ham X-SpamExperts-Outgoing-Evidence: SB/global_tokens (0.00662770253996) X-Recommended-Action: accept Sender: linux-rdma-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-rdma@vger.kernel.org X-Spam-Status: No, score=-7.5 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Avoid that closing /dev/infiniband/umad or /dev/infiniband/issm triggers a use-after-free. __fput() in fs/file_table.c invokes f_op->release() before it invokes cdev_put(). Make sure that the ib_umad_device structure is freed by the cdev_put() call instead of f_op->release(). This avoids that changing the port mode from IB into Ethernet and back to IB followed by restarting opensmd triggers the following kernel oops: general protection fault: 0000 [#1] PREEMPT SMP RIP: 0010:[] [] module_put+0x2c/0x170 Call Trace: [] cdev_put+0x20/0x30 [] __fput+0x1ae/0x1f0 [] ____fput+0xe/0x10 [] task_work_run+0xac/0xe0 [] do_notify_resume+0x9f/0xc0 [] int_signal+0x12/0x17 Reference: https://bugzilla.kernel.org/show_bug.cgi?id=75051 Signed-off-by: Bart Van Assche Cc: --- drivers/infiniband/core/user_mad.c | 37 ++++++++++++++++++++++++------------- 1 file changed, 24 insertions(+), 13 deletions(-) diff --git a/drivers/infiniband/core/user_mad.c b/drivers/infiniband/core/user_mad.c index 5c67d80..7bec4ca 100644 --- a/drivers/infiniband/core/user_mad.c +++ b/drivers/infiniband/core/user_mad.c @@ -98,7 +98,7 @@ struct ib_umad_port { struct ib_umad_device { int start_port, end_port; - struct kref ref; + struct kobject kobj; struct ib_umad_port port[0]; }; @@ -134,14 +134,18 @@ static DECLARE_BITMAP(dev_map, IB_UMAD_MAX_PORTS); static void ib_umad_add_one(struct ib_device *device); static void ib_umad_remove_one(struct ib_device *device); -static void ib_umad_release_dev(struct kref *ref) +static void ib_umad_release_dev(struct kobject *kobj) { struct ib_umad_device *dev = - container_of(ref, struct ib_umad_device, ref); + container_of(kobj, struct ib_umad_device, kobj); kfree(dev); } +static struct kobj_type ib_umad_dev_ktype = { + .release = ib_umad_release_dev, +}; + static int hdr_size(struct ib_umad_file *file) { return file->use_pkey_index ? sizeof (struct ib_user_mad_hdr) : @@ -783,7 +787,7 @@ static int ib_umad_open(struct inode *inode, struct file *filp) int ret = -ENXIO; port = container_of(inode->i_cdev, struct ib_umad_port, cdev); - kref_get(&port->umad_dev->ref); + kobject_get(&port->umad_dev->kobj); mutex_lock(&port->file_mutex); @@ -812,7 +816,7 @@ out: mutex_unlock(&port->file_mutex); if (ret) - kref_put(&port->umad_dev->ref, ib_umad_release_dev); + kobject_put(&port->umad_dev->kobj); return ret; } @@ -849,7 +853,7 @@ static int ib_umad_close(struct inode *inode, struct file *filp) mutex_unlock(&file->port->file_mutex); kfree(file); - kref_put(&dev->ref, ib_umad_release_dev); + kobject_put(&dev->kobj); return 0; } @@ -877,7 +881,7 @@ static int ib_umad_sm_open(struct inode *inode, struct file *filp) int ret; port = container_of(inode->i_cdev, struct ib_umad_port, sm_cdev); - kref_get(&port->umad_dev->ref); + kobject_get(&port->umad_dev->kobj); if (filp->f_flags & O_NONBLOCK) { if (down_trylock(&port->sm_sem)) { @@ -903,7 +907,7 @@ static int ib_umad_sm_open(struct inode *inode, struct file *filp) fail: if (ret) - kref_put(&port->umad_dev->ref, ib_umad_release_dev); + kobject_put(&port->umad_dev->kobj); return ret; clr_sm_cap: @@ -930,7 +934,7 @@ static int ib_umad_sm_close(struct inode *inode, struct file *filp) up(&port->sm_sem); - kref_put(&port->umad_dev->ref, ib_umad_release_dev); + kobject_put(&port->umad_dev->kobj); return ret; } @@ -998,6 +1002,7 @@ static int find_overflow_devnum(void) } static int ib_umad_init_port(struct ib_device *device, int port_num, + struct ib_umad_device *umad_dev, struct ib_umad_port *port) { int devnum; @@ -1063,6 +1068,11 @@ static int ib_umad_init_port(struct ib_device *device, int port_num, if (device_create_file(port->sm_dev, &dev_attr_port)) goto err_sm_dev; + port->cdev.kobj.parent = &umad_dev->kobj; + kobject_get(&umad_dev->kobj); + port->sm_cdev.kobj.parent = &umad_dev->kobj; + kobject_get(&umad_dev->kobj); + return 0; err_sm_dev: @@ -1141,7 +1151,7 @@ static void ib_umad_add_one(struct ib_device *device) if (!umad_dev) return; - kref_init(&umad_dev->ref); + kobject_init(&umad_dev->kobj, &ib_umad_dev_ktype); umad_dev->start_port = s; umad_dev->end_port = e; @@ -1149,7 +1159,8 @@ static void ib_umad_add_one(struct ib_device *device) for (i = s; i <= e; ++i) { umad_dev->port[i - s].umad_dev = umad_dev; - if (ib_umad_init_port(device, i, &umad_dev->port[i - s])) + if (ib_umad_init_port(device, i, umad_dev, + &umad_dev->port[i - s])) goto err; } @@ -1161,7 +1172,7 @@ err: while (--i >= s) ib_umad_kill_port(&umad_dev->port[i - s]); - kref_put(&umad_dev->ref, ib_umad_release_dev); + kobject_put(&umad_dev->kobj); } static void ib_umad_remove_one(struct ib_device *device) @@ -1175,7 +1186,7 @@ static void ib_umad_remove_one(struct ib_device *device) for (i = 0; i <= umad_dev->end_port - umad_dev->start_port; ++i) ib_umad_kill_port(&umad_dev->port[i]); - kref_put(&umad_dev->ref, ib_umad_release_dev); + kobject_put(&umad_dev->kobj); } static char *umad_devnode(struct device *dev, umode_t *mode)