f0abc761bb
The call to ->lookup_put() was too early and it caused an unlock of the
read/write protection of the uobject after the FD was put. This allows a
race:
CPU1 CPU2
rdma_lookup_put_uobject()
lookup_put_fd_uobject()
fput()
fput()
uverbs_uobject_fd_release()
WARN_ON(uverbs_try_lock_object(uobj,
UVERBS_LOOKUP_WRITE));
atomic_dec(usecnt)
Fix the code by changing the order, first unlock and call to
->lookup_put() after that.
Fixes:
|
||
|---|---|---|
| .. | ||
| addr.c | ||
| agent.c | ||
| agent.h | ||
| cache.c | ||
| cgroup.c | ||
| cm_msgs.h | ||
| cm.c | ||
| cma_configfs.c | ||
| cma_priv.h | ||
| cma_trace.c | ||
| cma_trace.h | ||
| cma.c | ||
| core_priv.h | ||
| counters.c | ||
| cq.c | ||
| device.c | ||
| fmr_pool.c | ||
| ib_core_uverbs.c | ||
| iwcm.c | ||
| iwcm.h | ||
| iwpm_msg.c | ||
| iwpm_util.c | ||
| iwpm_util.h | ||
| mad_priv.h | ||
| mad_rmpp.c | ||
| mad_rmpp.h | ||
| mad.c | ||
| Makefile | ||
| mr_pool.c | ||
| multicast.c | ||
| netlink.c | ||
| nldev.c | ||
| opa_smi.h | ||
| packer.c | ||
| rdma_core.c | ||
| rdma_core.h | ||
| restrack.c | ||
| restrack.h | ||
| roce_gid_mgmt.c | ||
| rw.c | ||
| sa_query.c | ||
| sa.h | ||
| security.c | ||
| smi.c | ||
| smi.h | ||
| sysfs.c | ||
| trace.c | ||
| ucma.c | ||
| ud_header.c | ||
| umem_odp.c | ||
| umem.c | ||
| user_mad.c | ||
| uverbs_cmd.c | ||
| uverbs_ioctl.c | ||
| uverbs_main.c | ||
| uverbs_marshall.c | ||
| uverbs_std_types_async_fd.c | ||
| uverbs_std_types_counters.c | ||
| uverbs_std_types_cq.c | ||
| uverbs_std_types_device.c | ||
| uverbs_std_types_dm.c | ||
| uverbs_std_types_flow_action.c | ||
| uverbs_std_types_mr.c | ||
| uverbs_std_types.c | ||
| uverbs_uapi.c | ||
| uverbs.h | ||
| verbs.c | ||