diff options
| author | Bryan Tan <bryantan@vmware.com> | 2017-12-20 20:51:40 +0300 |
|---|---|---|
| committer | Jason Gunthorpe <jgg@mellanox.com> | 2017-12-22 02:06:07 +0300 |
| commit | e3524b269e451cff68b19f32b15448933a53a4f4 (patch) | |
| tree | 4ced0a83b6f8adcea83e478bfba004780ba71901 /drivers/infiniband/hw/vmw_pvrdma/pvrdma.h | |
| parent | 30a366a9dabd05a0d218288b7d732649886b6a53 (diff) | |
| download | linux-e3524b269e451cff68b19f32b15448933a53a4f4.tar.xz | |
RDMA/vmw_pvrdma: Avoid use after free due to QP/CQ/SRQ destroy
The use of wait queues in vmw_pvrdma for handling concurrent
access to a resource leaves a race condition which can cause a use
after free bug.
Fix this by using the pattern from other drivers, complete() protected by
dec_and_test to ensure complete() is called only once.
Fixes: 29c8d9eba550 ("IB: Add vmw_pvrdma driver")
Signed-off-by: Bryan Tan <bryantan@vmware.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Diffstat (limited to 'drivers/infiniband/hw/vmw_pvrdma/pvrdma.h')
| -rw-r--r-- | drivers/infiniband/hw/vmw_pvrdma/pvrdma.h | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma.h b/drivers/infiniband/hw/vmw_pvrdma/pvrdma.h index 63bc2efc34eb..4f7bd3b6a315 100644 --- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma.h +++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma.h @@ -94,7 +94,7 @@ struct pvrdma_cq { u32 cq_handle; bool is_kernel; atomic_t refcnt; - wait_queue_head_t wait; + struct completion free; }; struct pvrdma_id_table { @@ -175,7 +175,7 @@ struct pvrdma_srq { u32 srq_handle; int npages; refcount_t refcnt; - wait_queue_head_t wait; + struct completion free; }; struct pvrdma_qp { @@ -197,7 +197,7 @@ struct pvrdma_qp { bool is_kernel; struct mutex mutex; /* QP state mutex. */ atomic_t refcnt; - wait_queue_head_t wait; + struct completion free; }; struct pvrdma_dev { |