Skip to content

Commit f0abc76

Browse files
Leon Romanovskyjgunthorpe
authored andcommitted
RDMA/core: Fix race between destroy and release FD object
The call to ->lookup_put() was too early and it caused an unlock of the read/write protection of the uobject after the FD was put. This allows a race: CPU1 CPU2 rdma_lookup_put_uobject() lookup_put_fd_uobject() fput() fput() uverbs_uobject_fd_release() WARN_ON(uverbs_try_lock_object(uobj, UVERBS_LOOKUP_WRITE)); atomic_dec(usecnt) Fix the code by changing the order, first unlock and call to ->lookup_put() after that. Fixes: 3832125 ("IB/core: Add support for idr types") Link: https://lore.kernel.org/r/[email protected] Suggested-by: Jason Gunthorpe <[email protected]> Signed-off-by: Leon Romanovsky <[email protected]> Signed-off-by: Jason Gunthorpe <[email protected]>
1 parent 47c370c commit f0abc76

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

drivers/infiniband/core/rdma_core.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -678,7 +678,6 @@ void rdma_lookup_put_uobject(struct ib_uobject *uobj,
678678
enum rdma_lookup_mode mode)
679679
{
680680
assert_uverbs_usecnt(uobj, mode);
681-
uobj->uapi_object->type_class->lookup_put(uobj, mode);
682681
/*
683682
* In order to unlock an object, either decrease its usecnt for
684683
* read access or zero it in case of exclusive access. See
@@ -695,6 +694,7 @@ void rdma_lookup_put_uobject(struct ib_uobject *uobj,
695694
break;
696695
}
697696

697+
uobj->uapi_object->type_class->lookup_put(uobj, mode);
698698
/* Pairs with the kref obtained by type->lookup_get */
699699
uverbs_uobject_put(uobj);
700700
}

0 commit comments

Comments
 (0)