Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c62998f1 authored by Jason Gunthorpe's avatar Jason Gunthorpe Committed by Greg Kroah-Hartman
Browse files

RDMA/ucma: Fix locking for ctx->events_reported 

[ Upstream commit 98837c6c3d7285f6eca86480b6f7fac6880e27a8 ]

This value is locked under the file->mut, ensure it is held whenever
touching it.

The case in ucma_migrate_id() is a race, while in ucma_free_uctx() it is
already not possible for the write side to run, the movement is just for
clarity.

Fixes: 88314e4d ("RDMA/cma: add support for rdma_migrate_id()")
Link: https://lore.kernel.org/r/20200818120526.702120-10-leon@kernel.org


Signed-off-by: default avatarLeon Romanovsky <leonro@mellanox.com>
Signed-off-by: default avatarJason Gunthorpe <jgg@nvidia.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 97ebcf05

drivers/infiniband/core/ucma.c

+3 −1
Original line number Diff line number Diff line
@@ -588,6 +588,7 @@ static int ucma_free_ctx(struct ucma_context *ctx) 
			list_move_tail(&uevent->list, &list);

	}

	list_del(&ctx->list);

	events_reported = ctx->events_reported;

	mutex_unlock(&ctx->file->mut);



	list_for_each_entry_safe(uevent, tmp, &list, list) {
@@ -597,7 +598,6 @@ static int ucma_free_ctx(struct ucma_context *ctx) 
		kfree(uevent);

	}



	events_reported = ctx->events_reported;

	mutex_destroy(&ctx->mutex);

	kfree(ctx);

	return events_reported;
@@ -1644,7 +1644,9 @@ static ssize_t ucma_migrate_id(struct ucma_file *new_file, 


	cur_file = ctx->file;

	if (cur_file == new_file) {

		mutex_lock(&cur_file->mut);

		resp.events_reported = ctx->events_reported;

		mutex_unlock(&cur_file->mut);

		goto response;

	}