linux_dsm_epyc7002/drivers/infiniband/core
Leon Romanovsky a23ba98e91 RDMA/core: Always release restrack object
[ Upstream commit 3d8287544223a3d2f37981c1f9ffd94d0b5e9ffc ]

Change location of rdma_restrack_del() to fix the bug where
task_struct was acquired but not released, causing to resource leak.

  ucma_create_id() {
    ucma_alloc_ctx();
    rdma_create_user_id() {
      rdma_restrack_new();
      rdma_restrack_set_name() {
        rdma_restrack_attach_task.part.0(); <--- task_struct was gotten
      }
    }
    ucma_destroy_private_ctx() {
      ucma_put_ctx();
      rdma_destroy_id() {
        _destroy_id()                       <--- id_priv was freed
      }
    }
  }

Fixes: 889d916b6f8a ("RDMA/core: Don't access cm_id after its destruction")
Link: https://lore.kernel.org/r/073ec27acb943ca8b6961663c47c5abe78a5c8cc.1624948948.git.leonro@nvidia.com
Reported-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-07-14 16:56:32 +02:00
..
addr.c RDMA/addr: Be strict with gid size 2021-04-14 08:42:12 +02:00
agent.c RDMA: Mark if destroy address handle is in a sleepable context 2018-12-19 16:28:03 -07:00
agent.h
cache.c RDMA/core: Fix empty gid table for non IB/RoCE devices 2020-12-07 16:32:04 -04:00
cgroup.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 288 2019-06-05 17:36:37 +02:00
cm_msgs.h RDMA/cm: Remove CM message structs 2020-01-25 15:11:37 -04:00
cm_trace.c RDMA/cm: Replace pr_debug() call sites with tracepoints 2020-08-24 19:41:41 -03:00
cm_trace.h RDMA/cm: Add tracepoints to track MAD send operations 2020-08-24 19:41:41 -03:00
cm.c RDMA/core: Fix corrupted SL on passive side 2021-05-14 09:50:32 +02:00
cma_configfs.c RDMA/cma: Fix error flow in default_roce_mode_store 2021-01-27 11:55:08 +01:00
cma_priv.h RDMA/ucma: Extend ucma_connect to receive ECE parameters 2020-05-27 16:05:05 -03:00
cma_trace.c RDMA/cma: Add trace points in RDMA Connection Manager 2020-01-07 16:10:53 -04:00
cma_trace.h RDMA/core: Move the rdma_show_ib_cm_event() macro 2020-08-24 16:01:47 -03:00
cma.c RDMA/core: Always release restrack object 2021-07-14 16:56:32 +02:00
core_priv.h RDMA/restrack: Improve readability in task name management 2020-09-22 19:47:35 -03:00
counters.c RDMA/restrack: Improve readability in task name management 2020-09-22 19:47:35 -03:00
cq.c RDMA/restrack: Improve readability in task name management 2020-09-22 19:47:35 -03:00
device.c RDMA/core: remove use of dma_virt_ops 2021-01-09 13:46:24 +01:00
ib_core_uverbs.c RDMA/core: Ensure that rdma_user_mmap_entry_remove() is a fence 2020-01-25 14:48:33 -04:00
iwcm.c RDMA/iwcm: Fix iwcm work deallocation 2020-03-04 14:28:25 -04:00
iwcm.h
iwpm_msg.c RDMA/iwpm: Delete unnecessary checks before the macro call "dev_kfree_skb" 2019-08-27 13:09:23 -03:00
iwpm_util.c RDMA/iwpm: Delete unnecessary checks before the macro call "dev_kfree_skb" 2019-08-27 13:09:23 -03:00
iwpm_util.h infiniband: fix core/ipwm_util.h kernel-doc warnings 2019-10-22 14:45:31 -03:00
lag.c RDMA/core: Consider flow label when building skb 2020-05-06 16:51:43 -03:00
mad_priv.h IB/mad: Change atomics to refcount API 2020-06-24 16:43:45 -03:00
mad_rmpp.c IB/mad: Delete RMPP_STATE_CANCELING state 2020-06-24 16:43:45 -03:00
mad_rmpp.h
mad.c RDMA 5.9 merge window pull request 2020-08-06 16:43:36 -07:00
Makefile RDMA/cm: Replace pr_debug() call sites with tracepoints 2020-08-24 19:41:41 -03:00
mr_pool.c Linux 5.2-rc6 2019-06-28 21:18:23 -03:00
multicast.c RDMA: Allow ib_client's to fail when add() is called 2020-05-06 11:57:33 -03:00
netlink.c IB/core: Avoid deadlock during netlink message handling 2019-10-24 20:49:37 -03:00
nldev.c RDMA/netlink: Remove CAP_NET_RAW check when dump a raw QP 2020-07-29 15:51:19 -03:00
opa_smi.h RDMA: Start use ib_device_ops 2018-12-12 07:40:16 -07:00
packer.c
rdma_core.c RDMA/core: Remove ucontext->closing 2020-09-30 15:27:19 -03:00
rdma_core.h IB/uverbs: Introduce create/destroy QP commands over ioctl 2020-05-21 20:39:36 -03:00
restrack.c RDMA/restrack: Don't treat as an error allocation ID wrapping 2021-01-19 18:27:31 +01:00
restrack.h RDMA/restrack: Improve readability in task name management 2020-09-22 19:47:35 -03:00
roce_gid_mgmt.c net: core: introduce struct netdev_nested_priv for nested interface infrastructure 2020-09-28 15:00:15 -07:00
rw.c RDMA/core: remove use of dma_virt_ops 2021-01-09 13:46:24 +01:00
sa_query.c IB/sa: Resolv use-after-free in ib_nl_make_request() 2020-07-02 16:05:12 -03:00
sa.h RDMA/core: Annotate timeout as unsigned long 2018-10-16 13:34:01 -04:00
security.c RDMA/core: Ensure security pkey modify is not lost 2020-03-24 19:53:25 -03:00
smi.c
smi.h RDMA: Start use ib_device_ops 2018-12-12 07:40:16 -07:00
sysfs.c RDMA/core: Change rdma_get_gid_attr returned error code 2020-10-01 21:20:11 -03:00
trace.c RDMA/core: Clean up tracepoint headers 2020-07-06 14:54:46 -03:00
ucma.c RDMA/ucma: Do not miss ctx destruction steps in some cases 2021-01-27 11:55:05 +01:00
ud_header.c RDMA/core: Use sizeof_field() helper 2020-05-27 13:46:05 -03:00
umem_odp.c IB/core: Enable ODP sync without faulting 2020-10-01 16:44:05 -03:00
umem.c RDMA/umem: Use ib_dma_max_seg_size instead of dma_get_max_seg_size 2021-03-17 17:06:37 +01:00
user_mad.c IB/umad: Return EPOLLERR in case of when device disassociated 2021-03-04 11:38:01 +01:00
uverbs_cmd.c RDMA/core: Sanitize WQ state received from the userspace 2021-07-14 16:56:19 +02:00
uverbs_ioctl.c treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
uverbs_main.c RDMA 5.10 pull request 2020-10-17 11:18:18 -07:00
uverbs_marshall.c IB/cm: Replace members of sa_path_rec with 'struct sgid_attr *' 2018-06-25 14:19:57 -06:00
uverbs_std_types_async_fd.c RDMA/uverbs: Move IB_EVENT_DEVICE_FATAL to destroy_uobj 2020-05-12 17:02:25 -03:00
uverbs_std_types_counters.c RDMA: Make counters destroy symmetrical 2020-09-09 14:14:29 -03:00
uverbs_std_types_cq.c RDMA/restrack: Improve readability in task name management 2020-09-22 19:47:35 -03:00
uverbs_std_types_device.c RDMA/uverbs: Fix a NULL vs IS_ERR() bug 2021-05-26 12:06:49 +02:00
uverbs_std_types_dm.c IB: When attrs.udata/ufile is available use that instead of uobject 2019-04-08 13:05:25 -03:00
uverbs_std_types_flow_action.c IB: When attrs.udata/ufile is available use that instead of uobject 2019-04-08 13:05:25 -03:00
uverbs_std_types_mr.c RDMA/core: Track device memory MRs 2020-12-30 11:53:24 +01:00
uverbs_std_types_qp.c IB/uverbs: Introduce create/destroy QP commands over ioctl 2020-05-21 20:39:36 -03:00
uverbs_std_types_srq.c IB/uverbs: Introduce create/destroy SRQ commands over ioctl 2020-05-21 20:39:35 -03:00
uverbs_std_types_wq.c RDMA: Restore ability to return error for destroy WQ 2020-09-09 14:14:29 -03:00
uverbs_std_types.c RDMA: Convert RWQ table logic to ib_core allocation scheme 2020-09-17 14:04:33 -03:00
uverbs_uapi.c IB/uverbs: Introduce create/destroy QP commands over ioctl 2020-05-21 20:39:36 -03:00
uverbs.h IB/uverbs: Extend CQ to get its own asynchronous event FD 2020-05-21 20:34:53 -03:00
verbs.c RDMA/core: Fix error return in _ib_modify_qp() 2020-12-30 11:52:58 +01:00