From: Sasha Levin Date: Fri, 21 Feb 2020 16:00:02 +0000 (-0500) Subject: Drop rdma-uverbs-remove-needs_kfree_rcu-from-uverbs_obj_t.patch X-Git-Tag: v4.19.106~9 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=cde3b4be7117edcfe922063a8a5053259419d9c2;p=thirdparty%2Fkernel%2Fstable-queue.git Drop rdma-uverbs-remove-needs_kfree_rcu-from-uverbs_obj_t.patch Signed-off-by: Sasha Levin --- diff --git a/queue-4.19/rdma-uverbs-remove-needs_kfree_rcu-from-uverbs_obj_t.patch b/queue-4.19/rdma-uverbs-remove-needs_kfree_rcu-from-uverbs_obj_t.patch deleted file mode 100644 index 8fcd8632e7b..00000000000 --- a/queue-4.19/rdma-uverbs-remove-needs_kfree_rcu-from-uverbs_obj_t.patch +++ /dev/null @@ -1,90 +0,0 @@ -From 17be9d6df64305f2e7dda4a82a6288af379cbaf0 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Mon, 13 Jan 2020 14:33:10 +0000 -Subject: RDMA/uverbs: Remove needs_kfree_rcu from uverbs_obj_type_class - -From: Jason Gunthorpe - -[ Upstream commit 8bdf9dd984c18375d1090ddeb1792511f619c5c1 ] - -After device disassociation the uapi_objects are destroyed and freed, -however it is still possible that core code can be holding a kref on the -uobject. When it finally goes to uverbs_uobject_free() via the kref_put() -it can trigger a use-after-free on the uapi_object. - -Since needs_kfree_rcu is a micro optimization that only benefits file -uobjects, just get rid of it. There is no harm in using kfree_rcu even if -it isn't required, and the number of involved objects is small. - -Link: https://lore.kernel.org/r/20200113143306.GA28717@ziepe.ca -Signed-off-by: Michael Guralnik -Signed-off-by: Jason Gunthorpe -Signed-off-by: Sasha Levin ---- - drivers/infiniband/core/rdma_core.c | 23 +---------------------- - include/rdma/uverbs_types.h | 1 - - 2 files changed, 1 insertion(+), 23 deletions(-) - -diff --git a/drivers/infiniband/core/rdma_core.c b/drivers/infiniband/core/rdma_core.c -index c4118bcd51035..c2c9bd72b350f 100644 ---- a/drivers/infiniband/core/rdma_core.c -+++ b/drivers/infiniband/core/rdma_core.c -@@ -49,13 +49,7 @@ void uverbs_uobject_get(struct ib_uobject *uobject) - - static void uverbs_uobject_free(struct kref *ref) - { -- struct ib_uobject *uobj = -- container_of(ref, struct ib_uobject, ref); -- -- if (uobj->uapi_object->type_class->needs_kfree_rcu) -- kfree_rcu(uobj, rcu); -- else -- kfree(uobj); -+ kfree_rcu(container_of(ref, struct ib_uobject, ref), rcu); - } - - void uverbs_uobject_put(struct ib_uobject *uobject) -@@ -753,20 +747,6 @@ const struct uverbs_obj_type_class uverbs_idr_class = { - .lookup_put = lookup_put_idr_uobject, - .destroy_hw = destroy_hw_idr_uobject, - .remove_handle = remove_handle_idr_uobject, -- /* -- * When we destroy an object, we first just lock it for WRITE and -- * actually DESTROY it in the finalize stage. So, the problematic -- * scenario is when we just started the finalize stage of the -- * destruction (nothing was executed yet). Now, the other thread -- * fetched the object for READ access, but it didn't lock it yet. -- * The DESTROY thread continues and starts destroying the object. -- * When the other thread continue - without the RCU, it would -- * access freed memory. However, the rcu_read_lock delays the free -- * until the rcu_read_lock of the READ operation quits. Since the -- * exclusive lock of the object is still taken by the DESTROY flow, the -- * READ operation will get -EBUSY and it'll just bail out. -- */ -- .needs_kfree_rcu = true, - }; - EXPORT_SYMBOL(uverbs_idr_class); - -@@ -954,7 +934,6 @@ const struct uverbs_obj_type_class uverbs_fd_class = { - .lookup_put = lookup_put_fd_uobject, - .destroy_hw = destroy_hw_fd_uobject, - .remove_handle = remove_handle_fd_uobject, -- .needs_kfree_rcu = false, - }; - EXPORT_SYMBOL(uverbs_fd_class); - -diff --git a/include/rdma/uverbs_types.h b/include/rdma/uverbs_types.h -index acb1bfa3cc99a..f70155cc73979 100644 ---- a/include/rdma/uverbs_types.h -+++ b/include/rdma/uverbs_types.h -@@ -97,7 +97,6 @@ struct uverbs_obj_type_class { - int __must_check (*destroy_hw)(struct ib_uobject *uobj, - enum rdma_remove_reason why); - void (*remove_handle)(struct ib_uobject *uobj); -- u8 needs_kfree_rcu; - }; - - struct uverbs_obj_type { --- -2.20.1 - diff --git a/queue-4.19/series b/queue-4.19/series index 01ee2e0b391..e5183e88ef4 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -111,7 +111,6 @@ input-edt-ft5x06-work-around-first-register-access-e.patch x86-nmi-remove-irq_work-from-the-long-duration-nmi-h.patch wan-ixp4xx_hss-fix-compile-testing-on-64-bit.patch asoc-atmel-fix-build-error-with-config_snd_atmel_soc.patch -rdma-uverbs-remove-needs_kfree_rcu-from-uverbs_obj_t.patch tty-synclinkmp-adjust-indentation-in-several-functio.patch tty-synclink_gt-adjust-indentation-in-several-functi.patch visorbus-fix-uninitialized-variable-access.patch diff --git a/queue-5.4/rdma-uverbs-remove-needs_kfree_rcu-from-uverbs_obj_t.patch b/queue-5.4/rdma-uverbs-remove-needs_kfree_rcu-from-uverbs_obj_t.patch deleted file mode 100644 index 01e30688e5a..00000000000 --- a/queue-5.4/rdma-uverbs-remove-needs_kfree_rcu-from-uverbs_obj_t.patch +++ /dev/null @@ -1,90 +0,0 @@ -From 5675fbf51e6c7cc9574e1b82dd2917f3861a9c0b Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Mon, 13 Jan 2020 14:33:10 +0000 -Subject: RDMA/uverbs: Remove needs_kfree_rcu from uverbs_obj_type_class - -From: Jason Gunthorpe - -[ Upstream commit 8bdf9dd984c18375d1090ddeb1792511f619c5c1 ] - -After device disassociation the uapi_objects are destroyed and freed, -however it is still possible that core code can be holding a kref on the -uobject. When it finally goes to uverbs_uobject_free() via the kref_put() -it can trigger a use-after-free on the uapi_object. - -Since needs_kfree_rcu is a micro optimization that only benefits file -uobjects, just get rid of it. There is no harm in using kfree_rcu even if -it isn't required, and the number of involved objects is small. - -Link: https://lore.kernel.org/r/20200113143306.GA28717@ziepe.ca -Signed-off-by: Michael Guralnik -Signed-off-by: Jason Gunthorpe -Signed-off-by: Sasha Levin ---- - drivers/infiniband/core/rdma_core.c | 23 +---------------------- - include/rdma/uverbs_types.h | 1 - - 2 files changed, 1 insertion(+), 23 deletions(-) - -diff --git a/drivers/infiniband/core/rdma_core.c b/drivers/infiniband/core/rdma_core.c -index ccf4d069c25c9..7dd9bd1e4d118 100644 ---- a/drivers/infiniband/core/rdma_core.c -+++ b/drivers/infiniband/core/rdma_core.c -@@ -49,13 +49,7 @@ void uverbs_uobject_get(struct ib_uobject *uobject) - - static void uverbs_uobject_free(struct kref *ref) - { -- struct ib_uobject *uobj = -- container_of(ref, struct ib_uobject, ref); -- -- if (uobj->uapi_object->type_class->needs_kfree_rcu) -- kfree_rcu(uobj, rcu); -- else -- kfree(uobj); -+ kfree_rcu(container_of(ref, struct ib_uobject, ref), rcu); - } - - void uverbs_uobject_put(struct ib_uobject *uobject) -@@ -744,20 +738,6 @@ const struct uverbs_obj_type_class uverbs_idr_class = { - .lookup_put = lookup_put_idr_uobject, - .destroy_hw = destroy_hw_idr_uobject, - .remove_handle = remove_handle_idr_uobject, -- /* -- * When we destroy an object, we first just lock it for WRITE and -- * actually DESTROY it in the finalize stage. So, the problematic -- * scenario is when we just started the finalize stage of the -- * destruction (nothing was executed yet). Now, the other thread -- * fetched the object for READ access, but it didn't lock it yet. -- * The DESTROY thread continues and starts destroying the object. -- * When the other thread continue - without the RCU, it would -- * access freed memory. However, the rcu_read_lock delays the free -- * until the rcu_read_lock of the READ operation quits. Since the -- * exclusive lock of the object is still taken by the DESTROY flow, the -- * READ operation will get -EBUSY and it'll just bail out. -- */ -- .needs_kfree_rcu = true, - }; - EXPORT_SYMBOL(uverbs_idr_class); - -@@ -919,7 +899,6 @@ const struct uverbs_obj_type_class uverbs_fd_class = { - .lookup_put = lookup_put_fd_uobject, - .destroy_hw = destroy_hw_fd_uobject, - .remove_handle = remove_handle_fd_uobject, -- .needs_kfree_rcu = false, - }; - EXPORT_SYMBOL(uverbs_fd_class); - -diff --git a/include/rdma/uverbs_types.h b/include/rdma/uverbs_types.h -index d57a5ba00c743..0b0f5a5f392de 100644 ---- a/include/rdma/uverbs_types.h -+++ b/include/rdma/uverbs_types.h -@@ -98,7 +98,6 @@ struct uverbs_obj_type_class { - enum rdma_remove_reason why, - struct uverbs_attr_bundle *attrs); - void (*remove_handle)(struct ib_uobject *uobj); -- u8 needs_kfree_rcu; - }; - - struct uverbs_obj_type { --- -2.20.1 - diff --git a/queue-5.4/series b/queue-5.4/series index d489b6c5199..b7ba9a6e744 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -209,7 +209,6 @@ arm-dts-rockchip-add-reg-property-to-brcmf-sub-node-.patch alsa-usb-audio-add-boot-quirk-for-motu-m-series.patch asoc-atmel-fix-build-error-with-config_snd_atmel_soc.patch raid6-test-fix-a-compilation-warning.patch -rdma-uverbs-remove-needs_kfree_rcu-from-uverbs_obj_t.patch tty-synclinkmp-adjust-indentation-in-several-functio.patch tty-synclink_gt-adjust-indentation-in-several-functi.patch misc-xilinx_sdfec-fix-xsdfec_poll-s-return-type.patch diff --git a/queue-5.5/rdma-uverbs-remove-needs_kfree_rcu-from-uverbs_obj_t.patch b/queue-5.5/rdma-uverbs-remove-needs_kfree_rcu-from-uverbs_obj_t.patch deleted file mode 100644 index 158eaf1520c..00000000000 --- a/queue-5.5/rdma-uverbs-remove-needs_kfree_rcu-from-uverbs_obj_t.patch +++ /dev/null @@ -1,90 +0,0 @@ -From 8c433fb82bc79a88433a1f13396feb6e26346676 Mon Sep 17 00:00:00 2001 -From: Sasha Levin -Date: Mon, 13 Jan 2020 14:33:10 +0000 -Subject: RDMA/uverbs: Remove needs_kfree_rcu from uverbs_obj_type_class - -From: Jason Gunthorpe - -[ Upstream commit 8bdf9dd984c18375d1090ddeb1792511f619c5c1 ] - -After device disassociation the uapi_objects are destroyed and freed, -however it is still possible that core code can be holding a kref on the -uobject. When it finally goes to uverbs_uobject_free() via the kref_put() -it can trigger a use-after-free on the uapi_object. - -Since needs_kfree_rcu is a micro optimization that only benefits file -uobjects, just get rid of it. There is no harm in using kfree_rcu even if -it isn't required, and the number of involved objects is small. - -Link: https://lore.kernel.org/r/20200113143306.GA28717@ziepe.ca -Signed-off-by: Michael Guralnik -Signed-off-by: Jason Gunthorpe -Signed-off-by: Sasha Levin ---- - drivers/infiniband/core/rdma_core.c | 23 +---------------------- - include/rdma/uverbs_types.h | 1 - - 2 files changed, 1 insertion(+), 23 deletions(-) - -diff --git a/drivers/infiniband/core/rdma_core.c b/drivers/infiniband/core/rdma_core.c -index 6c72773faf291..17bdbe38fdfa5 100644 ---- a/drivers/infiniband/core/rdma_core.c -+++ b/drivers/infiniband/core/rdma_core.c -@@ -49,13 +49,7 @@ void uverbs_uobject_get(struct ib_uobject *uobject) - - static void uverbs_uobject_free(struct kref *ref) - { -- struct ib_uobject *uobj = -- container_of(ref, struct ib_uobject, ref); -- -- if (uobj->uapi_object->type_class->needs_kfree_rcu) -- kfree_rcu(uobj, rcu); -- else -- kfree(uobj); -+ kfree_rcu(container_of(ref, struct ib_uobject, ref), rcu); - } - - void uverbs_uobject_put(struct ib_uobject *uobject) -@@ -744,20 +738,6 @@ const struct uverbs_obj_type_class uverbs_idr_class = { - .lookup_put = lookup_put_idr_uobject, - .destroy_hw = destroy_hw_idr_uobject, - .remove_handle = remove_handle_idr_uobject, -- /* -- * When we destroy an object, we first just lock it for WRITE and -- * actually DESTROY it in the finalize stage. So, the problematic -- * scenario is when we just started the finalize stage of the -- * destruction (nothing was executed yet). Now, the other thread -- * fetched the object for READ access, but it didn't lock it yet. -- * The DESTROY thread continues and starts destroying the object. -- * When the other thread continue - without the RCU, it would -- * access freed memory. However, the rcu_read_lock delays the free -- * until the rcu_read_lock of the READ operation quits. Since the -- * exclusive lock of the object is still taken by the DESTROY flow, the -- * READ operation will get -EBUSY and it'll just bail out. -- */ -- .needs_kfree_rcu = true, - }; - EXPORT_SYMBOL(uverbs_idr_class); - -@@ -920,7 +900,6 @@ const struct uverbs_obj_type_class uverbs_fd_class = { - .lookup_put = lookup_put_fd_uobject, - .destroy_hw = destroy_hw_fd_uobject, - .remove_handle = remove_handle_fd_uobject, -- .needs_kfree_rcu = false, - }; - EXPORT_SYMBOL(uverbs_fd_class); - -diff --git a/include/rdma/uverbs_types.h b/include/rdma/uverbs_types.h -index d57a5ba00c743..0b0f5a5f392de 100644 ---- a/include/rdma/uverbs_types.h -+++ b/include/rdma/uverbs_types.h -@@ -98,7 +98,6 @@ struct uverbs_obj_type_class { - enum rdma_remove_reason why, - struct uverbs_attr_bundle *attrs); - void (*remove_handle)(struct ib_uobject *uobj); -- u8 needs_kfree_rcu; - }; - - struct uverbs_obj_type { --- -2.20.1 - diff --git a/queue-5.5/series b/queue-5.5/series index 060260fd7eb..d8b8be5836e 100644 --- a/queue-5.5/series +++ b/queue-5.5/series @@ -240,7 +240,6 @@ alsa-usb-audio-add-boot-quirk-for-motu-m-series.patch asoc-txx9-remove-unused-rtd-variable.patch asoc-atmel-fix-build-error-with-config_snd_atmel_soc.patch raid6-test-fix-a-compilation-warning.patch -rdma-uverbs-remove-needs_kfree_rcu-from-uverbs_obj_t.patch tty-synclinkmp-adjust-indentation-in-several-functio.patch tty-synclink_gt-adjust-indentation-in-several-functi.patch bus-fsl-mc-properly-empty-initialize-structure.patch