]> git.proxmox.com Git - mirror_ubuntu-jammy-kernel.git/commit - drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c
RDMA/vmw_pvrdma: Avoid use after free due to QP/CQ/SRQ destroy
authorBryan Tan <bryantan@vmware.com>
Wed, 20 Dec 2017 17:51:40 +0000 (09:51 -0800)
committerJason Gunthorpe <jgg@mellanox.com>
Thu, 21 Dec 2017 23:06:07 +0000 (16:06 -0700)
commite3524b269e451cff68b19f32b15448933a53a4f4
tree4ced0a83b6f8adcea83e478bfba004780ba71901
parent30a366a9dabd05a0d218288b7d732649886b6a53
RDMA/vmw_pvrdma: Avoid use after free due to QP/CQ/SRQ destroy

The use of wait queues in vmw_pvrdma for handling concurrent
access to a resource leaves a race condition which can cause a use
after free bug.

Fix this by using the pattern from other drivers, complete() protected by
dec_and_test to ensure complete() is called only once.

Fixes: 29c8d9eba550 ("IB: Add vmw_pvrdma driver")
Signed-off-by: Bryan Tan <bryantan@vmware.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
drivers/infiniband/hw/vmw_pvrdma/pvrdma.h
drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c
drivers/infiniband/hw/vmw_pvrdma/pvrdma_main.c
drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c
drivers/infiniband/hw/vmw_pvrdma/pvrdma_srq.c