Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d7c1fbd6 authored by Steve Wise's avatar Steve Wise Committed by Roland Dreier
Browse files

RDMA/iwcm: Don't access a cm_id after dropping reference 



cm_work_handler() can access cm_id_priv after it drops its reference
by calling iwch_deref_id(), which might cause it to be freed.  The fix
is to look at whether IWCM_F_CALLBACK_DESTROY is set _before_ dropping
the reference.  Then if it was set, free the cm_id on this thread.

Signed-off-by: default avatarSteve Wise <swise@opengridcomputing.com>
Signed-off-by: default avatarRoland Dreier <rolandd@cisco.com>
parent d33ed425

drivers/infiniband/core/iwcm.c

+3 −2
Original line number Diff line number Diff line
@@ -839,6 +839,7 @@ static void cm_work_handler(struct work_struct *_work) 
	unsigned long flags;

	int empty;

	int ret = 0;

	int destroy_id;



	spin_lock_irqsave(&cm_id_priv->lock, flags);

	empty = list_empty(&cm_id_priv->work_list);
@@ -857,9 +858,9 @@ static void cm_work_handler(struct work_struct *_work) 
			destroy_cm_id(&cm_id_priv->id);

		}

		BUG_ON(atomic_read(&cm_id_priv->refcount)==0);

		destroy_id = test_bit(IWCM_F_CALLBACK_DESTROY, &cm_id_priv->flags);

		if (iwcm_deref_id(cm_id_priv)) {

			if (test_bit(IWCM_F_CALLBACK_DESTROY,

				     &cm_id_priv->flags)) {

			if (destroy_id) {

				BUG_ON(!list_empty(&cm_id_priv->work_list));

				free_cm_id(cm_id_priv);

			}