diff options
| author |   Bryan Tan <bryantan@vmware.com> | 2017-12-20 09:51:40 -0800 |
|---|---|---|
| committer |   Jason Gunthorpe <jgg@mellanox.com> | 2017-12-21 16:06:07 -0700 |
| commit | e3524b269e451cff68b19f32b15448933a53a4f4 (patch) | |
| tree | 4ced0a83b6f8adcea83e478bfba004780ba71901 /drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c | |
| parent | RDMA/vmw_pvrdma: Use refcount_dec_and_test to avoid warning (diff) | |
| download | linux-dev-e3524b269e451cff68b19f32b15448933a53a4f4.tar.xz linux-dev-e3524b269e451cff68b19f32b15448933a53a4f4.zip | |
RDMA/vmw_pvrdma: Avoid use after free due to QP/CQ/SRQ destroy
The use of wait queues in vmw_pvrdma for handling concurrent
access to a resource leaves a race condition which can cause a use
after free bug.
Fix this by using the pattern from other drivers, complete() protected by
dec_and_test to ensure complete() is called only once.
Fixes: 29c8d9eba550 ("IB: Add vmw_pvrdma driver")
Signed-off-by: Bryan Tan <bryantan@vmware.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Diffstat (limited to 'drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c')
| -rw-r--r-- | drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c index 3562c0c30492..e529622cefad 100644 --- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c +++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c @@ -179,7 +179,7 @@ struct ib_cq *pvrdma_create_cq(struct ib_device *ibdev, pvrdma_page_dir_insert_umem(&cq->pdir, cq->umem, 0); atomic_set(&cq->refcnt, 1); - init_waitqueue_head(&cq->wait); + init_completion(&cq->free); spin_lock_init(&cq->cq_lock); memset(cmd, 0, sizeof(*cmd)); @@ -230,8 +230,9 @@ err_cq: static void pvrdma_free_cq(struct pvrdma_dev *dev, struct pvrdma_cq *cq) { - atomic_dec(&cq->refcnt); - wait_event(cq->wait, !atomic_read(&cq->refcnt)); + if (atomic_dec_and_test(&cq->refcnt)) + complete(&cq->free); + wait_for_completion(&cq->free); if (!cq->is_kernel) ib_umem_release(cq->umem); |