+++ /dev/null
-From 17be9d6df64305f2e7dda4a82a6288af379cbaf0 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 13 Jan 2020 14:33:10 +0000
-Subject: RDMA/uverbs: Remove needs_kfree_rcu from uverbs_obj_type_class
-
-From: Jason Gunthorpe <jgg@mellanox.com>
-
-[ Upstream commit 8bdf9dd984c18375d1090ddeb1792511f619c5c1 ]
-
-After device disassociation the uapi_objects are destroyed and freed,
-however it is still possible that core code can be holding a kref on the
-uobject. When it finally goes to uverbs_uobject_free() via the kref_put()
-it can trigger a use-after-free on the uapi_object.
-
-Since needs_kfree_rcu is a micro optimization that only benefits file
-uobjects, just get rid of it. There is no harm in using kfree_rcu even if
-it isn't required, and the number of involved objects is small.
-
-Link: https://lore.kernel.org/r/20200113143306.GA28717@ziepe.ca
-Signed-off-by: Michael Guralnik <michaelgur@mellanox.com>
-Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/infiniband/core/rdma_core.c | 23 +----------------------
- include/rdma/uverbs_types.h | 1 -
- 2 files changed, 1 insertion(+), 23 deletions(-)
-
-diff --git a/drivers/infiniband/core/rdma_core.c b/drivers/infiniband/core/rdma_core.c
-index c4118bcd51035..c2c9bd72b350f 100644
---- a/drivers/infiniband/core/rdma_core.c
-+++ b/drivers/infiniband/core/rdma_core.c
-@@ -49,13 +49,7 @@ void uverbs_uobject_get(struct ib_uobject *uobject)
-
- static void uverbs_uobject_free(struct kref *ref)
- {
-- struct ib_uobject *uobj =
-- container_of(ref, struct ib_uobject, ref);
--
-- if (uobj->uapi_object->type_class->needs_kfree_rcu)
-- kfree_rcu(uobj, rcu);
-- else
-- kfree(uobj);
-+ kfree_rcu(container_of(ref, struct ib_uobject, ref), rcu);
- }
-
- void uverbs_uobject_put(struct ib_uobject *uobject)
-@@ -753,20 +747,6 @@ const struct uverbs_obj_type_class uverbs_idr_class = {
- .lookup_put = lookup_put_idr_uobject,
- .destroy_hw = destroy_hw_idr_uobject,
- .remove_handle = remove_handle_idr_uobject,
-- /*
-- * When we destroy an object, we first just lock it for WRITE and
-- * actually DESTROY it in the finalize stage. So, the problematic
-- * scenario is when we just started the finalize stage of the
-- * destruction (nothing was executed yet). Now, the other thread
-- * fetched the object for READ access, but it didn't lock it yet.
-- * The DESTROY thread continues and starts destroying the object.
-- * When the other thread continue - without the RCU, it would
-- * access freed memory. However, the rcu_read_lock delays the free
-- * until the rcu_read_lock of the READ operation quits. Since the
-- * exclusive lock of the object is still taken by the DESTROY flow, the
-- * READ operation will get -EBUSY and it'll just bail out.
-- */
-- .needs_kfree_rcu = true,
- };
- EXPORT_SYMBOL(uverbs_idr_class);
-
-@@ -954,7 +934,6 @@ const struct uverbs_obj_type_class uverbs_fd_class = {
- .lookup_put = lookup_put_fd_uobject,
- .destroy_hw = destroy_hw_fd_uobject,
- .remove_handle = remove_handle_fd_uobject,
-- .needs_kfree_rcu = false,
- };
- EXPORT_SYMBOL(uverbs_fd_class);
-
-diff --git a/include/rdma/uverbs_types.h b/include/rdma/uverbs_types.h
-index acb1bfa3cc99a..f70155cc73979 100644
---- a/include/rdma/uverbs_types.h
-+++ b/include/rdma/uverbs_types.h
-@@ -97,7 +97,6 @@ struct uverbs_obj_type_class {
- int __must_check (*destroy_hw)(struct ib_uobject *uobj,
- enum rdma_remove_reason why);
- void (*remove_handle)(struct ib_uobject *uobj);
-- u8 needs_kfree_rcu;
- };
-
- struct uverbs_obj_type {
---
-2.20.1
-
x86-nmi-remove-irq_work-from-the-long-duration-nmi-h.patch
wan-ixp4xx_hss-fix-compile-testing-on-64-bit.patch
asoc-atmel-fix-build-error-with-config_snd_atmel_soc.patch
-rdma-uverbs-remove-needs_kfree_rcu-from-uverbs_obj_t.patch
tty-synclinkmp-adjust-indentation-in-several-functio.patch
tty-synclink_gt-adjust-indentation-in-several-functi.patch
visorbus-fix-uninitialized-variable-access.patch
+++ /dev/null
-From 5675fbf51e6c7cc9574e1b82dd2917f3861a9c0b Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 13 Jan 2020 14:33:10 +0000
-Subject: RDMA/uverbs: Remove needs_kfree_rcu from uverbs_obj_type_class
-
-From: Jason Gunthorpe <jgg@mellanox.com>
-
-[ Upstream commit 8bdf9dd984c18375d1090ddeb1792511f619c5c1 ]
-
-After device disassociation the uapi_objects are destroyed and freed,
-however it is still possible that core code can be holding a kref on the
-uobject. When it finally goes to uverbs_uobject_free() via the kref_put()
-it can trigger a use-after-free on the uapi_object.
-
-Since needs_kfree_rcu is a micro optimization that only benefits file
-uobjects, just get rid of it. There is no harm in using kfree_rcu even if
-it isn't required, and the number of involved objects is small.
-
-Link: https://lore.kernel.org/r/20200113143306.GA28717@ziepe.ca
-Signed-off-by: Michael Guralnik <michaelgur@mellanox.com>
-Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/infiniband/core/rdma_core.c | 23 +----------------------
- include/rdma/uverbs_types.h | 1 -
- 2 files changed, 1 insertion(+), 23 deletions(-)
-
-diff --git a/drivers/infiniband/core/rdma_core.c b/drivers/infiniband/core/rdma_core.c
-index ccf4d069c25c9..7dd9bd1e4d118 100644
---- a/drivers/infiniband/core/rdma_core.c
-+++ b/drivers/infiniband/core/rdma_core.c
-@@ -49,13 +49,7 @@ void uverbs_uobject_get(struct ib_uobject *uobject)
-
- static void uverbs_uobject_free(struct kref *ref)
- {
-- struct ib_uobject *uobj =
-- container_of(ref, struct ib_uobject, ref);
--
-- if (uobj->uapi_object->type_class->needs_kfree_rcu)
-- kfree_rcu(uobj, rcu);
-- else
-- kfree(uobj);
-+ kfree_rcu(container_of(ref, struct ib_uobject, ref), rcu);
- }
-
- void uverbs_uobject_put(struct ib_uobject *uobject)
-@@ -744,20 +738,6 @@ const struct uverbs_obj_type_class uverbs_idr_class = {
- .lookup_put = lookup_put_idr_uobject,
- .destroy_hw = destroy_hw_idr_uobject,
- .remove_handle = remove_handle_idr_uobject,
-- /*
-- * When we destroy an object, we first just lock it for WRITE and
-- * actually DESTROY it in the finalize stage. So, the problematic
-- * scenario is when we just started the finalize stage of the
-- * destruction (nothing was executed yet). Now, the other thread
-- * fetched the object for READ access, but it didn't lock it yet.
-- * The DESTROY thread continues and starts destroying the object.
-- * When the other thread continue - without the RCU, it would
-- * access freed memory. However, the rcu_read_lock delays the free
-- * until the rcu_read_lock of the READ operation quits. Since the
-- * exclusive lock of the object is still taken by the DESTROY flow, the
-- * READ operation will get -EBUSY and it'll just bail out.
-- */
-- .needs_kfree_rcu = true,
- };
- EXPORT_SYMBOL(uverbs_idr_class);
-
-@@ -919,7 +899,6 @@ const struct uverbs_obj_type_class uverbs_fd_class = {
- .lookup_put = lookup_put_fd_uobject,
- .destroy_hw = destroy_hw_fd_uobject,
- .remove_handle = remove_handle_fd_uobject,
-- .needs_kfree_rcu = false,
- };
- EXPORT_SYMBOL(uverbs_fd_class);
-
-diff --git a/include/rdma/uverbs_types.h b/include/rdma/uverbs_types.h
-index d57a5ba00c743..0b0f5a5f392de 100644
---- a/include/rdma/uverbs_types.h
-+++ b/include/rdma/uverbs_types.h
-@@ -98,7 +98,6 @@ struct uverbs_obj_type_class {
- enum rdma_remove_reason why,
- struct uverbs_attr_bundle *attrs);
- void (*remove_handle)(struct ib_uobject *uobj);
-- u8 needs_kfree_rcu;
- };
-
- struct uverbs_obj_type {
---
-2.20.1
-
alsa-usb-audio-add-boot-quirk-for-motu-m-series.patch
asoc-atmel-fix-build-error-with-config_snd_atmel_soc.patch
raid6-test-fix-a-compilation-warning.patch
-rdma-uverbs-remove-needs_kfree_rcu-from-uverbs_obj_t.patch
tty-synclinkmp-adjust-indentation-in-several-functio.patch
tty-synclink_gt-adjust-indentation-in-several-functi.patch
misc-xilinx_sdfec-fix-xsdfec_poll-s-return-type.patch
+++ /dev/null
-From 8c433fb82bc79a88433a1f13396feb6e26346676 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 13 Jan 2020 14:33:10 +0000
-Subject: RDMA/uverbs: Remove needs_kfree_rcu from uverbs_obj_type_class
-
-From: Jason Gunthorpe <jgg@mellanox.com>
-
-[ Upstream commit 8bdf9dd984c18375d1090ddeb1792511f619c5c1 ]
-
-After device disassociation the uapi_objects are destroyed and freed,
-however it is still possible that core code can be holding a kref on the
-uobject. When it finally goes to uverbs_uobject_free() via the kref_put()
-it can trigger a use-after-free on the uapi_object.
-
-Since needs_kfree_rcu is a micro optimization that only benefits file
-uobjects, just get rid of it. There is no harm in using kfree_rcu even if
-it isn't required, and the number of involved objects is small.
-
-Link: https://lore.kernel.org/r/20200113143306.GA28717@ziepe.ca
-Signed-off-by: Michael Guralnik <michaelgur@mellanox.com>
-Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/infiniband/core/rdma_core.c | 23 +----------------------
- include/rdma/uverbs_types.h | 1 -
- 2 files changed, 1 insertion(+), 23 deletions(-)
-
-diff --git a/drivers/infiniband/core/rdma_core.c b/drivers/infiniband/core/rdma_core.c
-index 6c72773faf291..17bdbe38fdfa5 100644
---- a/drivers/infiniband/core/rdma_core.c
-+++ b/drivers/infiniband/core/rdma_core.c
-@@ -49,13 +49,7 @@ void uverbs_uobject_get(struct ib_uobject *uobject)
-
- static void uverbs_uobject_free(struct kref *ref)
- {
-- struct ib_uobject *uobj =
-- container_of(ref, struct ib_uobject, ref);
--
-- if (uobj->uapi_object->type_class->needs_kfree_rcu)
-- kfree_rcu(uobj, rcu);
-- else
-- kfree(uobj);
-+ kfree_rcu(container_of(ref, struct ib_uobject, ref), rcu);
- }
-
- void uverbs_uobject_put(struct ib_uobject *uobject)
-@@ -744,20 +738,6 @@ const struct uverbs_obj_type_class uverbs_idr_class = {
- .lookup_put = lookup_put_idr_uobject,
- .destroy_hw = destroy_hw_idr_uobject,
- .remove_handle = remove_handle_idr_uobject,
-- /*
-- * When we destroy an object, we first just lock it for WRITE and
-- * actually DESTROY it in the finalize stage. So, the problematic
-- * scenario is when we just started the finalize stage of the
-- * destruction (nothing was executed yet). Now, the other thread
-- * fetched the object for READ access, but it didn't lock it yet.
-- * The DESTROY thread continues and starts destroying the object.
-- * When the other thread continue - without the RCU, it would
-- * access freed memory. However, the rcu_read_lock delays the free
-- * until the rcu_read_lock of the READ operation quits. Since the
-- * exclusive lock of the object is still taken by the DESTROY flow, the
-- * READ operation will get -EBUSY and it'll just bail out.
-- */
-- .needs_kfree_rcu = true,
- };
- EXPORT_SYMBOL(uverbs_idr_class);
-
-@@ -920,7 +900,6 @@ const struct uverbs_obj_type_class uverbs_fd_class = {
- .lookup_put = lookup_put_fd_uobject,
- .destroy_hw = destroy_hw_fd_uobject,
- .remove_handle = remove_handle_fd_uobject,
-- .needs_kfree_rcu = false,
- };
- EXPORT_SYMBOL(uverbs_fd_class);
-
-diff --git a/include/rdma/uverbs_types.h b/include/rdma/uverbs_types.h
-index d57a5ba00c743..0b0f5a5f392de 100644
---- a/include/rdma/uverbs_types.h
-+++ b/include/rdma/uverbs_types.h
-@@ -98,7 +98,6 @@ struct uverbs_obj_type_class {
- enum rdma_remove_reason why,
- struct uverbs_attr_bundle *attrs);
- void (*remove_handle)(struct ib_uobject *uobj);
-- u8 needs_kfree_rcu;
- };
-
- struct uverbs_obj_type {
---
-2.20.1
-
asoc-txx9-remove-unused-rtd-variable.patch
asoc-atmel-fix-build-error-with-config_snd_atmel_soc.patch
raid6-test-fix-a-compilation-warning.patch
-rdma-uverbs-remove-needs_kfree_rcu-from-uverbs_obj_t.patch
tty-synclinkmp-adjust-indentation-in-several-functio.patch
tty-synclink_gt-adjust-indentation-in-several-functi.patch
bus-fsl-mc-properly-empty-initialize-structure.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
