]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
RDMA/core: Add CM to restrack after successful attachment to a device
authorShay Drory <shayd@nvidia.com>
Sun, 18 Apr 2021 13:55:54 +0000 (16:55 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 14 May 2021 08:50:15 +0000 (10:50 +0200)
commit073fdf539d4c022162db3d77a5afca1710f0de2d
treecb29eea81c7c0725c8d32670bca6b2dc7ae9aa73
parentfd1a3e72c157b8ec2a73b00da385575469eed9d0
RDMA/core: Add CM to restrack after successful attachment to a device

[ Upstream commit cb5cd0ea4eb3ce338a593a5331ddb4986ae20faa ]

The device attach triggers addition of CM_ID to the restrack DB.
However, when error occurs, we releasing this device, but defer CM_ID
release. This causes to the situation where restrack sees CM_ID that
is not valid anymore.

As a solution, add the CM_ID to the resource tracking DB only after the
attachment is finished.

Found by syzcaller:
infiniband syz0: added syz_tun
rdma_rxe: ignoring netdev event = 10 for syz_tun
infiniband syz0: set down
infiniband syz0: ib_query_port failed (-19)
restrack: ------------[ cut here    ]------------
infiniband syz0: BUG: RESTRACK detected leak of resources
restrack: User CM_ID object allocated by syz-executor716 is not freed
restrack: ------------[ cut here    ]------------

Fixes: b09c4d701220 ("RDMA/restrack: Improve readability in task name management")
Link: https://lore.kernel.org/r/ab93e56ba831eac65c322b3256796fa1589ec0bb.1618753862.git.leonro@nvidia.com
Signed-off-by: Shay Drory <shayd@nvidia.com>
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/infiniband/core/cma.c