From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Cyrus-Session-Id: sloti22d1t05-1646895-1516797974-2-14325020558524587016 X-Sieve: CMU Sieve 3.0 X-Spam-known-sender: no X-Spam-score: 0.0 X-Spam-hits: BAYES_00 -1.9, HEADER_FROM_DIFFERENT_DOMAINS 0.25, ME_NOAUTH 0.01, RCVD_IN_DNSWL_HI -5, T_RP_MATCHES_RCVD -0.01, LANGUAGES en, BAYES_USED global, SA_VERSION 3.4.0 X-Spam-source: IP='209.132.180.67', Host='vger.kernel.org', Country='US', FromHeader='com', MailFrom='org' X-Spam-charsets: X-Resolved-to: greg@kroah.com X-Delivered-to: greg@kroah.com X-Mail-from: stable-owner@vger.kernel.org ARC-Seal: i=1; a=rsa-sha256; cv=none; d=messagingengine.com; s=arctest; t=1516797974; b=EG46n6ubtLJOwxciONAwf9EOwDWqfPB9SRYI4DfFuwdEDMx 43JcwFqGPqPcNQD4X4F9Eqtb3rjJm1CgEZ4uVCJ1j4gT22xfbnjhDxnOLtTaiQkz W6+lWOhhpIniUn0Ox87AVkqxuGXtMQQVQwUf5Zwl6rpxunv3D0+AjOFEgekw7FUR /LHTEwq/MqQ8MojsAewpTYJpqx/w7GAyxyWe8Cn/ERHC9ohM6UprzmEJDQATW8ZZ GE1ivmpWsWnlomdn1qfY6V9xASBUZEqD8ASyshtIA2LRkCR1YxUudTJvhXJTkHDc O2tAugDLRHjCO9Cwj+eFRcrpGM+mWGCz8b3qCaQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=from:to:cc:subject:date:message-id :in-reply-to:references:sender:list-id; s=arctest; t=1516797974; bh=3urJzTe4tp/eUq3Uxeky0i4SQofry7sGiy3Zm+DsSNw=; b=qpCLXVpFcUhx q5lUlaG9i2qnZO5dvaGJL1l1K1U1XkN9VjbFkSq5LixrF+uEXjtcNoR2tFr1oQkW 5Tt0TSxU2eqWKjCfuqSG3+vh6PE3UQ1gEhpDXgmR2eFimfnK0vu0X5jN8hlBcF9F //zJLey9erqR623FYl6ECtm7A3V7GF/S3D9xvxKUXnbSDXb7PYtjLUfATPG8ORo/ U3QR+Q9cz4IaoQoKX1DVGQH9RaFZzUs6YTEr6Qpistjinftf59CrI5r9qcfq+6r3 bXuT8fWvbpvnBevpmSIH8A02pjik+qApXbHfr6ZSwgyIvyKT7MS6yDo60DRne/SZ /szY0+TUzQ== ARC-Authentication-Results: i=1; mx2.messagingengine.com; arc=none (no signatures found); dkim=none (no signatures found); dmarc=none (p=none,has-list-id=yes,d=none) header.from=intel.com; iprev=pass policy.iprev=209.132.180.67 (vger.kernel.org); spf=none smtp.mailfrom=stable-owner@vger.kernel.org smtp.helo=vger.kernel.org; x-aligned-from=fail; x-ptr=pass x-ptr-helo=vger.kernel.org x-ptr-lookup=vger.kernel.org; x-return-mx=pass smtp.domain=vger.kernel.org smtp.result=pass smtp_org.domain=kernel.org smtp_org.result=pass smtp_is_org_domain=no header.domain=intel.com header.result=pass header_is_org_domain=yes Authentication-Results: mx2.messagingengine.com; arc=none (no signatures found); dkim=none (no signatures found); dmarc=none (p=none,has-list-id=yes,d=none) header.from=intel.com; iprev=pass policy.iprev=209.132.180.67 (vger.kernel.org); spf=none smtp.mailfrom=stable-owner@vger.kernel.org smtp.helo=vger.kernel.org; x-aligned-from=fail; x-ptr=pass x-ptr-helo=vger.kernel.org x-ptr-lookup=vger.kernel.org; x-return-mx=pass smtp.domain=vger.kernel.org smtp.result=pass smtp_org.domain=kernel.org smtp_org.result=pass smtp_is_org_domain=no header.domain=intel.com header.result=pass header_is_org_domain=yes Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933691AbeAXMqJ (ORCPT ); Wed, 24 Jan 2018 07:46:09 -0500 Received: from mga06.intel.com ([134.134.136.31]:14700 "EHLO mga06.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S933684AbeAXMqI (ORCPT ); Wed, 24 Jan 2018 07:46:08 -0500 X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.46,407,1511856000"; d="scan'208";a="198407431" From: Dmitry Eremin To: Greg Kroah-Hartman , devel@driverdev.osuosl.org, Oleg Drokin , Andreas Dilger , James Simmons Cc: Linux Kernel Mailing List , Lustre Development List , Dmitry Eremin , , Dmitry Eremin Subject: [PATCH v2] staging: lustre: Fix avoid intensive reconnecting for ko2iblnd patch Date: Wed, 24 Jan 2018 15:45:36 +0300 Message-Id: <1516797936-5938-1-git-send-email-dmitry.eremin@intel.com> X-Mailer: git-send-email 1.8.3.1 In-Reply-To: <20180122103924.GB23996@kroah.com> References: <20180122103924.GB23996@kroah.com> Organization: Intel Sender: stable-owner@vger.kernel.org X-Mailing-List: stable@vger.kernel.org X-getmail-retrieved-from-mailbox: INBOX X-Mailing-List: linux-kernel@vger.kernel.org List-ID: From: Dmitry Eremin The logic of the original commit 4d99b2581eff ("staging: lustre: avoid intensive reconnecting for ko2iblnd") was assumed conditional free of struct kib_conn if the second argument free_conn in function kiblnd_destroy_conn(struct kib_conn *conn, bool free_conn) is true. But this hunk of code was dropped from original commit. As result the logic works wrong and current code use struct kib_conn after free. > drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c > 3317 kiblnd_destroy_conn(conn, !peer); > ^^^^ Freed always (but should be conditionally) > 3318 > 3319 spin_lock_irqsave(lock, flags); > 3320 if (!peer) > 3321 continue; > 3322 > 3323 conn->ibc_peer = peer; > ^^^^^^^^^^^^^^ Use after free > 3324 if (peer->ibp_reconnected < KIB_RECONN_HIGH_RACE) > 3325 list_add_tail(&conn->ibc_list, > ^^^^^^^^^^^^^^ Use after free > 3326 &kiblnd_data.kib_reconn_list); > 3327 else > 3328 list_add_tail(&conn->ibc_list, > ^^^^^^^^^^^^^^ Use after free > 3329 &kiblnd_data.kib_reconn_wait); After attached patch this code will use struct kib_conn only when it was not freed. Cc: # v4.6 Fixes: 4d99b2581eff ("staging: lustre: avoid intensive reconnecting for ko2iblnd") Signed-off-by: Dmitry Eremin Signed-off-by: Dmitry Eremin --- drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd.c b/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd.c index 2ebc484385b3..a15a625ee9b6 100644 --- a/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd.c +++ b/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd.c @@ -890,7 +890,8 @@ void kiblnd_destroy_conn(struct kib_conn *conn, bool free_conn) atomic_dec(&net->ibn_nconns); } - kfree(conn); + if (free_conn) + kfree(conn); } int kiblnd_close_peer_conns_locked(struct kib_peer *peer, int why) -- 1.8.3.1 -------------------------------------------------------------------- Joint Stock Company Intel A/O Registered legal address: Krylatsky Hills Business Park, 17 Krylatskaya Str., Bldg 4, Moscow 121614, Russian Federation This e-mail and any attachments may contain confidential material for the sole use of the intended recipient(s). Any review or distribution by others is strictly prohibited. If you are not the intended recipient, please contact the sender and delete all copies.