aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/infiniband/sw/rxe
diff options
context:
space:
mode:
authorTejun Heo <tj@kernel.org>2018-03-14 12:45:10 -0700
committerJason Gunthorpe <jgg@mellanox.com>2018-03-15 15:38:19 -0600
commit95da6e96f1e74e6ddfb347f7a8310f419bb47bf7 (patch)
treeb177c6ac11105639dc26f2c2d50170b04f4d8681 /drivers/infiniband/sw/rxe
parentRDMA/qedr: eliminate duplicate barriers on weakly-ordered archs (diff)
downloadlinux-dev-95da6e96f1e74e6ddfb347f7a8310f419bb47bf7.tar.xz
linux-dev-95da6e96f1e74e6ddfb347f7a8310f419bb47bf7.zip
RDMAVT: Fix synchronization around percpu_ref
rvt_mregion uses percpu_ref for reference counting and RCU to protect accesses from lkey_table. When a rvt_mregion needs to be freed, it first gets unregistered from lkey_table and then rvt_check_refs() is called to wait for in-flight usages before the rvt_mregion is freed. rvt_check_refs() seems to have a couple issues. * It has a fast exit path which tests percpu_ref_is_zero(). However, a percpu_ref reading zero doesn't mean that the object can be released. In fact, the ->release() callback might not even have started executing yet. Proceeding with freeing can lead to use-after-free. * lkey_table is RCU protected but there is no RCU grace period in the free path. percpu_ref uses RCU internally but it's sched-RCU whose grace periods are different from regular RCU. Also, it generally isn't a good idea to depend on internal behaviors like this. To address the above issues, this patch removes the fast exit and adds an explicit synchronize_rcu(). Signed-off-by: Tejun Heo <tj@kernel.org> Acked-by: Dennis Dalessandro <dennis.dalessandro@intel.com> Cc: Mike Marciniszyn <mike.marciniszyn@intel.com> Cc: linux-rdma@vger.kernel.org Cc: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Diffstat (limited to 'drivers/infiniband/sw/rxe')
0 files changed, 0 insertions, 0 deletions