From: Greg KH <gregkh@suse.de>
To: linux-kernel@vger.kernel.org, stable@kernel.org
Cc: stable-review@kernel.org, torvalds@linux-foundation.org,
akpm@linux-foundation.org, alan@lxorguk.ukuu.org.uk,
Sean Hefty <sean.hefty@intel.com>,
Doug Ledford <dledford@redhat.com>,
Roland Dreier <roland@purestorage.com>
Subject: [11/78] IB/cm: Bump reference count on cm_id before invoking callback
Date: Mon, 21 Mar 2011 16:01:27 -0700 [thread overview]
Message-ID: <20110321230322.787438625@clark.kroah.org> (raw)
In-Reply-To: <20110321230346.GA14681@kroah.com>
2.6.38-stable review patch. If anyone has any objections, please let us know.
------------------
From: Sean Hefty <sean.hefty@intel.com>
commit 29963437a48475036353b95ab142bf199adb909e upstream.
When processing a SIDR REQ, the ib_cm allocates a new cm_id. The
refcount of the cm_id is initialized to 1. However, cm_process_work
will decrement the refcount after invoking all callbacks. The result
is that the cm_id will end up with refcount set to 0 by the end of the
sidr req handler.
If a user tries to destroy the cm_id, the destruction will proceed,
under the incorrect assumption that no other threads are referencing
the cm_id. This can lead to a crash when the cm callback thread tries
to access the cm_id.
This problem was noticed as part of a larger investigation with kernel
crashes in the rdma_cm when running on a real time OS.
Signed-off-by: Sean Hefty <sean.hefty@intel.com>
Acked-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
drivers/infiniband/core/cm.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/infiniband/core/cm.c
+++ b/drivers/infiniband/core/cm.c
@@ -2989,6 +2989,7 @@ static int cm_sidr_req_handler(struct cm
goto out; /* No match. */
}
atomic_inc(&cur_cm_id_priv->refcount);
+ atomic_inc(&cm_id_priv->refcount);
spin_unlock_irq(&cm.lock);
cm_id_priv->id.cm_handler = cur_cm_id_priv->id.cm_handler;
next prev parent reply other threads:[~2011-03-21 23:32 UTC|newest]
Thread overview: 80+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-03-21 23:03 [00/78] 2.6.38.1-stable review Greg KH
2011-03-21 23:01 ` [01/78] dcache.c: create helper function for duplicated functionality Greg KH
2011-03-21 23:01 ` [02/78] VFS: Fix the nfs sillyrename regression in kernel 2.6.38 Greg KH
2011-03-21 23:01 ` [03/78] ftrace: Fix memory leak with function graph and cpu hotplug Greg KH
2011-03-21 23:01 ` [04/78] x86: Fix panic when handling "mem={invalid}" param Greg KH
2011-03-21 23:01 ` [05/78] x86: Emit "mem=nopentium ignored" warning when not supported Greg KH
2011-03-21 23:01 ` [06/78] ahci: AHCI mode SATA patch for Intel Patsburg SATA RAID controller Greg KH
2011-03-21 23:01 ` [07/78] ahci: recognize Marvell 88se9125 PCIe SATA 6.0 Gb/s controller Greg KH
2011-03-21 23:01 ` [08/78] libata: fix hotplug for drivers which dont implement LPM Greg KH
2011-03-21 23:01 ` [09/78] RDMA/cma: Fix crash in request handlers Greg KH
2011-03-21 23:01 ` [10/78] Increase OSF partition limit from 8 to 18 Greg KH
2011-03-21 23:01 ` Greg KH [this message]
2011-03-21 23:01 ` [12/78] x86, quirk: Fix SB600 revision check Greg KH
2011-03-21 23:01 ` [13/78] microblaze: Fix /dev/zero corruption from __clear_user() Greg KH
2011-03-21 23:01 ` [14/78] x86: stop_machine_text_poke() should issue sync_core() Greg KH
2011-03-21 23:01 ` [15/78] TOMOYO: Fix memory leak upon file open Greg KH
2011-03-21 23:01 ` [16/78] drm/i915: Replace vblank PM QoS with "Interrupt-Based AGPBUSY#" Greg KH
2011-03-21 23:01 ` [17/78] drm/radeon/kms: fix typo in atom overscan setup Greg KH
2011-03-21 23:01 ` [18/78] drm: Hold the mode mutex whilst probing for sysfs status Greg KH
2011-03-21 23:01 ` [19/78] ath9k_hw: read and backup AR_WA register value even before chip reset on Greg KH
2011-03-21 23:01 ` [20/78] ath9k_hw: Fix incorrect macversion and macrev checks Greg KH
2011-03-21 23:01 ` [21/78] ath9k: remove support for the FIF_PROMISC_IN_BSS filter flag Greg KH
2011-03-21 23:01 ` [22/78] serial: mrst_max3110: make buffer larger Greg KH
2011-03-21 23:01 ` [23/78] serial: also set the uartclk value in resume after goes to highspeed Greg KH
2011-03-21 23:01 ` [24/78] serial: change the divisor latch only when prescalar actually changed Greg KH
2011-03-21 23:01 ` [25/78] USB: serial drivers need to use larger bulk-in buffers Greg KH
2011-03-21 23:01 ` [26/78] USB: serial/kobil_sct, fix potential tty NULL dereference Greg KH
2011-03-21 23:01 ` [27/78] USB: serial: option: Apply OPTION_BLACKLIST_SENDSETUP also for ZTE MF626 Greg KH
2011-03-21 23:01 ` [28/78] USB: serial: ch341: add new id Greg KH
2011-03-21 23:01 ` [29/78] staging: winbond: needs <linux/delay.h> for msleep and friends Greg KH
2011-03-21 23:01 ` [30/78] staging: tidspbridge: protect dmm_map properly Greg KH
2011-03-21 23:01 ` [31/78] rtl8187: Change rate-control feedback Greg KH
2011-03-21 23:01 ` [32/78] USB: isp1760: Implement solution for erratum 2 Greg KH
2011-03-21 23:01 ` [33/78] ehci: Check individual port status registers on resume Greg KH
2011-03-21 23:01 ` [34/78] USB: move usbcore away from hcd->state Greg KH
2011-03-21 23:01 ` [35/78] xhci: Update internal dequeue pointers after stalls Greg KH
2011-03-21 23:01 ` [36/78] xhci: Fix cycle bit calculation during stall handling Greg KH
2011-03-21 23:01 ` [37/78] USB: Add support for SuperSpeed isoc endpoints Greg KH
2011-03-21 23:01 ` [38/78] ALSA: HDA: Enable surround and subwoofer on Lenovo Ideapad Y530 Greg KH
2011-03-21 23:01 ` [39/78] ALSA: HDA: Fix volume control naming for surround speakers on Realtek auto-parser Greg KH
2011-03-21 23:01 ` [40/78] ALSA: HDA: Fixup unnecessary volume control index on Realtek ALC88x Greg KH
2011-03-21 23:01 ` [41/78] ALSA: HDA: Realtek ALC88x: Do not over-initialize speakers and hp that are primary outputs Greg KH
2011-03-21 23:01 ` [42/78] ALSA: hda - fix digital mic selection in mixer on 92HD8X codecs Greg KH
2011-03-21 23:01 ` [43/78] ALSA: hda - Initialize special cases for input src in init phase Greg KH
2011-03-21 23:02 ` [44/78] HID: hid-magicmouse: Correct touch orientation direction Greg KH
2011-03-21 23:02 ` [45/78] HID: add support for Ortek PKB-1700 Greg KH
2011-03-21 23:02 ` [46/78] PCI: remove quirk for pre-production systems Greg KH
2011-03-21 23:33 ` Zhao, Yu
2011-03-21 23:02 ` [47/78] PCI: add more checking to ICH region quirks Greg KH
2011-03-21 23:02 ` [48/78] PCI: do not create quirk I/O regions below PCIBIOS_MIN_IO for ICH Greg KH
2011-03-21 23:02 ` [49/78] PCI: sysfs: Fix failure path for addition of "vpd" attribute Greg KH
2011-03-21 23:02 ` [50/78] ALSA: sound/pci/asihpi: check adapter index in hpi_ioctl Greg KH
2011-03-21 23:02 ` [51/78] ALSA: aloop - Fix possible IRQ lock inversion Greg KH
2011-03-21 23:02 ` [52/78] ALSA: ctxfi - Fix incorrect SPDIF status bit mask Greg KH
2011-03-21 23:02 ` [53/78] ALSA: ctxfi - Fix SPDIF status retrieval Greg KH
2011-03-21 23:02 ` [54/78] ALSA: ctxfi - Clear input settings before initialization Greg KH
2011-03-21 23:02 ` [55/78] ASoC: PXA: Z2: Fix codec pin name Greg KH
2011-03-21 23:02 ` [56/78] [SCSI] target: Fix volume size misreporting for volumes > 2TB Greg KH
2011-03-21 23:02 ` [57/78] [SCSI] scsi_dh_alua: fix deadlock in stpg_endio Greg KH
2011-03-21 23:02 ` [58/78] SUNRPC: Ensure we always run the tk_callback before tk_action Greg KH
2011-03-21 23:02 ` [59/78] RPC: killing RPC tasks races fixed Greg KH
2011-03-21 23:02 ` [60/78] perf: Fix the software events state check Greg KH
2011-03-21 23:02 ` [61/78] perf: Handle stopped state with tracepoints Greg KH
2011-03-21 23:02 ` [62/78] perf, powerpc: Handle events that raise an exception without overflowing Greg KH
2011-03-21 23:02 ` [63/78] perf tools: Version incorrect with some versions of grep Greg KH
2011-03-21 23:02 ` [64/78] ext3: Always set dx_nodes fake_dirent explicitly Greg KH
2011-03-21 23:02 ` [65/78] call_function_many: fix list delete vs add race Greg KH
2011-03-21 23:02 ` [66/78] call_function_many: add missing ordering Greg KH
2011-03-21 23:02 ` [67/78] smp_call_function_many: handle concurrent clearing of mask Greg KH
2011-03-21 23:02 ` [68/78] x86: Flush TLB if PGD entry is changed in i386 PAE mode Greg KH
2011-03-21 23:02 ` [69/78] HID: ACRUX - activate the device immediately after binding Greg KH
2011-03-21 23:02 ` [70/78] HID: Do not create input devices for feature reports Greg KH
2011-03-21 23:02 ` [71/78] [PARISC] fix per-cpu flag problem in the cpu affinity checkers Greg KH
2011-03-21 23:02 ` [72/78] Input: bcm5974 - add support for MacBookPro8 Greg KH
2011-03-21 23:02 ` [73/78] i2c: Fix typo in instantiating-devices document Greg KH
2011-03-21 23:02 ` [74/78] mmc: sdhci: Add Ricoh e823 PCI ID Greg KH
2011-03-21 23:02 ` [75/78] mmc: sdio: remember new card RCA when redetecting card Greg KH
2011-03-21 23:02 ` [76/78] x86, binutils, xen: Fix another wrong size directive Greg KH
2011-03-21 23:02 ` [77/78] davinci: DM644x EVM: register MUSB device earlier Greg KH
2011-03-21 23:02 ` [78/78] hwmon: (sht15) Fix integer overflow in humidity calculation Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20110321230322.787438625@clark.kroah.org \
--to=gregkh@suse.de \
--cc=akpm@linux-foundation.org \
--cc=alan@lxorguk.ukuu.org.uk \
--cc=dledford@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=roland@purestorage.com \
--cc=sean.hefty@intel.com \
--cc=stable-review@kernel.org \
--cc=stable@kernel.org \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®