IB/uverbs: Protect QP multicast list
Userspace verbs multicast attach/detach operations on a QP are done while holding the rwsem of the QP for reading. That's not sufficient since a reader lock allows more than one reader to acquire the lock. However, multicast attach/detach does list manipulation that can corrupt the list if multiple threads run in parallel. Fix this by acquiring the rwsem as a writer to serialize attach/detach operations. Add idr_write_qp() and put_qp_write() to encapsulate this. This fixes oops seen when running applications that perform multicast joins/leaves. Reported by: Mike Dubman <miked@mellanox.com> Signed-off-by: Eli Cohen <eli@mellanox.com> Cc: <stable@kernel.org> Signed-off-by: Roland Dreier <roland@purestorage.com>
This commit is contained in:
parent
5f0a6e2d50
commit
e214a0fe2b
|
@ -241,11 +241,24 @@ static struct ib_qp *idr_read_qp(int qp_handle, struct ib_ucontext *context)
|
|||
return idr_read_obj(&ib_uverbs_qp_idr, qp_handle, context, 0);
|
||||
}
|
||||
|
||||
static struct ib_qp *idr_write_qp(int qp_handle, struct ib_ucontext *context)
|
||||
{
|
||||
struct ib_uobject *uobj;
|
||||
|
||||
uobj = idr_write_uobj(&ib_uverbs_qp_idr, qp_handle, context);
|
||||
return uobj ? uobj->object : NULL;
|
||||
}
|
||||
|
||||
static void put_qp_read(struct ib_qp *qp)
|
||||
{
|
||||
put_uobj_read(qp->uobject);
|
||||
}
|
||||
|
||||
static void put_qp_write(struct ib_qp *qp)
|
||||
{
|
||||
put_uobj_write(qp->uobject);
|
||||
}
|
||||
|
||||
static struct ib_srq *idr_read_srq(int srq_handle, struct ib_ucontext *context)
|
||||
{
|
||||
return idr_read_obj(&ib_uverbs_srq_idr, srq_handle, context, 0);
|
||||
|
@ -2375,7 +2388,7 @@ ssize_t ib_uverbs_attach_mcast(struct ib_uverbs_file *file,
|
|||
if (copy_from_user(&cmd, buf, sizeof cmd))
|
||||
return -EFAULT;
|
||||
|
||||
qp = idr_read_qp(cmd.qp_handle, file->ucontext);
|
||||
qp = idr_write_qp(cmd.qp_handle, file->ucontext);
|
||||
if (!qp)
|
||||
return -EINVAL;
|
||||
|
||||
|
@ -2404,7 +2417,7 @@ ssize_t ib_uverbs_attach_mcast(struct ib_uverbs_file *file,
|
|||
kfree(mcast);
|
||||
|
||||
out_put:
|
||||
put_qp_read(qp);
|
||||
put_qp_write(qp);
|
||||
|
||||
return ret ? ret : in_len;
|
||||
}
|
||||
|
@ -2422,7 +2435,7 @@ ssize_t ib_uverbs_detach_mcast(struct ib_uverbs_file *file,
|
|||
if (copy_from_user(&cmd, buf, sizeof cmd))
|
||||
return -EFAULT;
|
||||
|
||||
qp = idr_read_qp(cmd.qp_handle, file->ucontext);
|
||||
qp = idr_write_qp(cmd.qp_handle, file->ucontext);
|
||||
if (!qp)
|
||||
return -EINVAL;
|
||||
|
||||
|
@ -2441,7 +2454,7 @@ ssize_t ib_uverbs_detach_mcast(struct ib_uverbs_file *file,
|
|||
}
|
||||
|
||||
out_put:
|
||||
put_qp_read(qp);
|
||||
put_qp_write(qp);
|
||||
|
||||
return ret ? ret : in_len;
|
||||
}
|
||||
|
|
Loading…
Reference in New Issue