mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-09-10 04:00:39 -04:00
Code Issues Packages Projects Releases Wiki Activity
Files
0d1fd39bb27e479fb1de3dd4b4c247c7c9a1fabf
linux/drivers
History
Leon Romanovsky 0d1fd39bb2 RDMA/core: Fix race in rdma_alloc_commit_uobject() 
The FD should not be installed until all of the setup is completed as the
fd_install() transfers ownership of the kref to the FD table. A thread can
race a close() and trigger concurrent rdma_alloc_commit_uobject() and
uverbs_uobject_fd_release() which, at least, triggers a safety WARN_ON:

  WARNING: CPU: 4 PID: 6913 at drivers/infiniband/core/rdma_core.c:768 uverbs_uobject_fd_release+0x202/0x230
  Kernel panic - not syncing: panic_on_warn set ...
  CPU: 4 PID: 6913 Comm: syz-executor.3 Not tainted 5.7.0-rc2 #22
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
  [..]
  RIP: 0010:uverbs_uobject_fd_release+0x202/0x230
  Code: fe 4c 89 e7 e8 af 23 fe ff e9 2a ff ff ff e8 c5 fa 61 fe be 03 00 00 00 4c 89 e7 e8 68 eb f5 fe e9 13 ff ff ff e8 ae fa 61 fe <0f> 0b eb ac e8 e5 aa 3c fe e8 50 2b 86 fe e9 6a fe ff ff e8 46 2b
  RSP: 0018:ffffc90008117d88 EFLAGS: 00010293
  RAX: ffff88810e146580 RBX: 1ffff92001022fb1 RCX: ffffffff82d5b902
  RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff88811951b040
  RBP: ffff88811951b000 R08: ffffed10232a3609 R09: ffffed10232a3609
  R10: ffff88811951b043 R11: 0000000000000001 R12: ffff888100a7c600
  R13: ffff888100a7c650 R14: ffffc90008117da8 R15: ffffffff82d5b700
   ? __uverbs_cleanup_ufile+0x270/0x270
   ? uverbs_uobject_fd_release+0x202/0x230
   ? uverbs_uobject_fd_release+0x202/0x230
   ? __uverbs_cleanup_ufile+0x270/0x270
   ? locks_remove_file+0x282/0x3d0
   ? security_file_free+0xaa/0xd0
   __fput+0x2be/0x770
   task_work_run+0x10e/0x1b0
   exit_to_usermode_loop+0x145/0x170
   do_syscall_64+0x2d0/0x390
   ? prepare_exit_to_usermode+0x17a/0x230
   entry_SYSCALL_64_after_hwframe+0x44/0xa9
  RIP: 0033:0x414da7
  Code: 00 00 0f 05 48 3d 00 f0 ff ff 77 3f f3 c3 0f 1f 44 00 00 53 89 fb 48 83 ec 10 e8 f4 fb ff ff 89 df 89 c2 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2b 89 d7 89 44 24 0c e8 36 fc ff ff 8b 44 24
  RSP: 002b:00007fff39d379d0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
  RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000414da7
  RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000003
  RBP: 00007fff39d37a3c R08: 0000000400000000 R09: 0000000400000000
  R10: 00007fff39d37910 R11: 0000000000000293 R12: 0000000000000001
  R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000003

Reorder so that fd_install() is the last thing done in
rdma_alloc_commit_uobject().

Fixes: aba94548c9 ("IB/uverbs: Move the FD uobj type struct file allocation to alloc_commit")
Link: https://lore.kernel.org/r/20200716102059.1420681-1-leon@kernel.org
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2020-07-16 09:58:53 -03:00
..
accessibility
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
acpi
Merge branch 'acpi-fan'
2020-07-03 16:15:31 +02:00
amba
ARM: tegra: Replace zero-length array with flexible-array
2020-06-15 23:08:28 -05:00
android
binder: fix null deref of proc->context
2020-06-23 07:54:46 +02:00
ata
Merge tag 'libata-5.8-2020-06-19' of git://git.kernel.dk/linux-block
2020-06-19 13:09:40 -07:00
atm
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
auxdisplay
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
base
Merge tag 'pm-5.8-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
2020-06-26 12:32:11 -07:00
bcma
…
block
Merge tag 'block-5.8-2020-07-10' of git://git.kernel.dk/linux-block
2020-07-10 09:55:46 -07:00
bluetooth
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next
2020-06-03 16:27:18 -07:00
bus
Merge tag 'omap-for-v5.8/fixes-merge-window-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into arm/fixes
2020-06-28 14:41:55 +02:00
cdrom
Merge branch 'work.sysctl' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2020-06-10 16:05:54 -07:00
char
Revert commit e918e57041 ("tpm_tis: Remove the HID IFX0102")
2020-07-07 04:25:17 +03:00
clk
clk: sifive: allocate sufficient memory for struct __prci_data
2020-06-25 15:04:13 -07:00
clocksource
arm64: arch_timer: Disable the compat vdso for cores affected by ARM64_WORKAROUND_1418040
2020-07-08 21:57:51 +01:00
connector
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
counter
…
cpufreq
cpufreq: intel_pstate: Add one more OOB control bit
2020-06-23 17:24:32 +02:00
cpuidle
cpuidle: Rearrange s2idle-specific idle state entry code
2020-06-25 13:52:53 +02:00
crypto
Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6
2020-06-21 10:01:03 -07:00
dax
device-dax: add memory via add_memory_driver_managed()
2020-06-04 19:06:23 -07:00
dca
…
devfreq
PM / devfreq: Use lockdep asserts instead of manual checks for locked mutex
2020-05-28 18:02:40 +09:00
dio
maccess: rename probe_kernel_{read,write} to copy_{from,to}_kernel_nofault
2020-06-17 10:57:41 -07:00
dma
dmaengine: tegra-apb: Replace zero-length array with flexible-array
2020-06-15 23:08:32 -05:00
dma-buf
dma-buf: Move dma_buf_release() from fops to dentry_ops
2020-06-25 16:05:40 +05:30
edac
EDAC/amd64: Read back the scrub rate PCI register on F15h
2020-06-18 20:25:25 +02:00
eisa
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
extcon
extcon: arizona: Fix runtime PM imbalance on error
2020-05-29 17:36:02 +09:00
firewire
firewire: ohci: Replace zero-length array with flexible-array
2020-06-15 23:08:31 -05:00
firmware
Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux
2020-07-10 08:42:17 -07:00
fpga
Merge tag 'fpga-fixes-for-5.8' of git://git.kernel.org/pub/scm/linux/kernel/git/mdf/linux-fpga into char-misc-next
2020-06-26 17:26:31 +02:00
fsi
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
gnss
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
gpio
Merge tag 'gpio-fixes-for-v5.8-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux into fixes
2020-06-26 23:53:25 +02:00
gpu
Merge tag 'amd-drm-fixes-5.8-2020-07-09' of git://people.freedesktop.org/~agd5f/linux into drm-fixes
2020-07-10 07:02:02 +10:00
greybus
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
hid
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
hsi
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
hv
Drivers: hv: Change flag to write log level in panic msg to false
2020-06-29 10:30:35 +00:00
hwmon
hwmon: (pmbus) fix a typo in Kconfig SENSORS_IR35221 option
2020-07-02 17:43:14 -07:00
hwspinlock
…
hwtracing
stm class: Replace zero-length array with flexible-array
2020-06-15 23:08:32 -05:00
i2c
i2c: mlxcpld: check correct size of maximum RECV_LEN packet
2020-07-04 08:20:38 +02:00
i3c
…
ide
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
idle
…
iio
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
infiniband
RDMA/core: Fix race in rdma_alloc_commit_uobject()
2020-07-16 09:58:53 -03:00
input
maccess: rename probe_kernel_{read,write} to copy_{from,to}_kernel_nofault
2020-06-17 10:57:41 -07:00
interconnect
Merge tag 'pm-5.8-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
2020-06-10 14:04:39 -07:00
iommu
iommu/vt-d: Fix misuse of iommu_domain_identity_map()
2020-06-23 10:08:32 +02:00
ipack
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
irqchip
Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm
2020-07-06 12:48:04 -07:00
isdn
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
leds
Merge tag 'leds-5.8-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/pavel/linux-leds
2020-06-04 11:03:45 -07:00
lightnvm
Merge tag 'for-5.8/block-2020-06-01' of git://git.kernel.dk/linux-block
2020-06-02 15:29:19 -07:00
macintosh
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
mailbox
mailbox: qcom: Add ipq6018 apcs compatible
2020-06-10 22:43:57 -05:00
mcb
…
md
dm: use noio when sending kobject event
2020-07-08 12:50:51 -04:00
media
media: omap3isp: remove cacheflush.h
2020-06-26 00:27:37 -07:00
memory
Merge branch 'baikal/drivers' into arm/drivers
2020-05-28 14:18:11 +02:00
memstick
…
message
scsi: mptfusion: Don't use GFP_ATOMIC for larger DMA allocations
2020-06-26 22:51:53 -04:00
mfd
mfd: mt6360: Fix register driver NULL pointer by adding driver name
2020-06-16 09:32:43 +01:00
misc
habanalabs: increase h/w timer when checking idle
2020-06-24 12:35:23 +03:00
mmc
mmc: sdhci-msm: Override DLL_CONFIG only if the valid value is supplied
2020-07-08 15:30:35 +02:00
most
…
mtd
mtd: rawnand: xway: Fix build issue
2020-07-07 21:04:38 +02:00
mux
…
net
mlxsw: pci: Fix use-after-free in case of failed devlink reload
2020-07-10 14:33:34 -07:00
nfc
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
ntb
NTB: perf: Fix race condition when run with ntb_test
2020-06-05 20:02:09 -04:00
nubus
…
nvdimm
libnvdimm/security: Fix key lookup permissions
2020-07-08 17:08:01 -07:00
nvme
nvme: fix a crash in nvme_mpath_add_disk
2020-07-02 10:38:00 +02:00
nvmem
nvmem: qfprom: remove incorrect write support
2020-05-27 11:09:26 +02:00
of
of: of_mdio: Correct loop scanning logic
2020-06-19 13:39:00 -07:00
opp
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
oprofile
oprofile: Replace zero-length array with flexible-array
2020-06-15 23:08:32 -05:00
parisc
…
parport
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
pci
Merge tag 'kbuild-v5.8-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild
2020-06-13 13:29:16 -07:00
pcmcia
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
perf
Merge tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux
2020-06-11 12:53:23 -07:00
phy
phy: samsung: Replace zero-length array with flexible-array
2020-06-15 23:08:32 -05:00
pinctrl
Merge tag 'intel-pinctrl-v5.8-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pinctrl/intel into fixes
2020-06-28 01:08:21 +02:00
platform
Merge tag 'kbuild-v5.8-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild
2020-06-13 13:29:16 -07:00
pnp
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
power
Merge tag 'for-v5.8' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply
2020-06-10 11:28:35 -07:00
powercap
Merge tag 'kbuild-v5.8-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild
2020-06-13 13:29:16 -07:00
pps
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
ps3
…
ptp
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
pwm
pwm: Add missing "CONFIG_" prefix
2020-06-04 19:09:28 +02:00
rapidio
rapidio: Replace zero-length array with flexible-array
2020-06-15 23:08:32 -05:00
ras
…
regulator
regulator: mt6358: Remove BROKEN dependency
2020-06-17 13:01:19 +01:00
remoteproc
Merge tag 'rproc-v5.8' of git://git.kernel.org/pub/scm/linux/kernel/git/andersson/remoteproc
2020-06-08 13:01:08 -07:00
reset
Merge tag 'char-misc-5.8-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc
2020-06-07 10:59:32 -07:00
rpmsg
Merge tag 'rproc-v5.8' of git://git.kernel.org/pub/scm/linux/kernel/git/andersson/remoteproc
2020-06-08 13:01:08 -07:00
rtc
Merge tag 'rtc-5.8' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux
2020-06-07 16:11:23 -07:00
s390
vfio-ccw: Fix a build error due to missing include of linux/slab.h
2020-07-03 11:41:31 +02:00
sbus
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
scsi
scsi: dh: Add Fujitsu device to devinfo and dh lists
2020-07-08 01:16:23 -04:00
sfi
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
sh
…
siox
…
slimbus
…
soc
Merge tag 'arm-omap-fixes-5.8-1' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc
2020-06-28 14:57:14 -07:00
soundwire
…
spi
Merge tag 'spi-fix-v5.8-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi
2020-06-29 10:10:16 -07:00
spmi
…
ssb
…
staging
Staging: rtl8723bs: prevent buffer overflow in update_sta_support_rate()
2020-06-16 21:25:38 +02:00
target
Merge tag 'kbuild-v5.8-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild
2020-06-13 13:29:16 -07:00
tc
…
tee
mmap locking API: use coccinelle to convert mmap_sem rwsem call sites
2020-06-09 09:39:14 -07:00
thermal
thermal/drivers/rcar_gen3: Fix undefined temperature if negative
2020-06-29 12:15:34 +02:00
thunderbolt
Merge tag 'usb-5.8-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb
2020-06-07 09:42:16 -07:00
tty
kdb: Switch to use safer dbg_io_ops over console APIs
2020-06-26 15:40:16 +01:00
uio
…
usb
Merge tag 'usb-5.8-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb
2020-06-27 13:12:10 -07:00
vdpa
vdpa: fix typos in the comments for __vdpa_alloc_device()
2020-06-22 12:34:21 -04:00
vfio
vfio/pci: Fix SR-IOV VF handling with MMIO blocking
2020-06-25 11:04:23 -06:00
vhost
tools/virtio: Add --reset
2020-06-22 12:34:21 -04:00
video
Merge tag 'drm-misc-fixes-2020-06-25' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes
2020-06-26 13:49:17 +10:00
virt
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
virtio
virtio-mem: add memory via add_memory_driver_managed()
2020-06-22 12:34:21 -04:00
visorbus
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
vlynq
…
vme
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
w1
w1: Replace zero-length array with flexible-array
2020-06-15 23:08:32 -05:00
watchdog
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
xen
Merge tag 'for-linus-5.8b-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip
2020-07-11 11:16:46 -07:00
zorro
treewide: replace '---help---' in Kconfig files with 'help'
2020-06-14 01:57:21 +09:00
Kconfig
…
Makefile
…