summaryrefslogtreecommitdiff
path: root/drivers/infiniband/core
diff options
context:
space:
mode:
authorJason Gunthorpe <jgg@mellanox.com>2018-09-29 01:28:02 +0300
committerJason Gunthorpe <jgg@mellanox.com>2018-10-04 01:01:40 +0300
commite73798f20ecb35f7d6c672d48d6b9da57c8cbf64 (patch)
treeb8ee7f7b3a89ccc1d278b22c605cff360e93cd01 /drivers/infiniband/core
parent914e5d7d4697fb9815fa237a4d42bfb952bf48d6 (diff)
downloadlinux-e73798f20ecb35f7d6c672d48d6b9da57c8cbf64.tar.xz
RDMA/uverbs: Fix RCU annotation for radix slot deference
The uapi radix tree is a write-once data structure protected by kref. Once we get to the ioctl() fop it is not possible for anything else to be writing to it, so the access should use rcu_dereference_protected. Reported-by: Matthew Wilcox <willy@infradead.org> Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Diffstat (limited to 'drivers/infiniband/core')
-rw-r--r--drivers/infiniband/core/uverbs_ioctl.c9
1 files changed, 3 insertions, 6 deletions
diff --git a/drivers/infiniband/core/uverbs_ioctl.c b/drivers/infiniband/core/uverbs_ioctl.c
index 0e95a5888274..b0e493e8d860 100644
--- a/drivers/infiniband/core/uverbs_ioctl.c
+++ b/drivers/infiniband/core/uverbs_ioctl.c
@@ -386,8 +386,7 @@ static int uverbs_set_attr(struct bundle_priv *pbundle,
return -EPROTONOSUPPORT;
return 0;
}
- attr = srcu_dereference(
- *slot, &pbundle->bundle.ufile->device->disassociate_srcu);
+ attr = rcu_dereference_protected(*slot, true);
/* Reject duplicate attributes from user-space */
if (test_bit(attr_bkey, pbundle->bundle.attr_present))
@@ -498,9 +497,7 @@ static int bundle_destroy(struct bundle_priv *pbundle, bool commit)
if (WARN_ON(!slot))
continue;
- attr_uapi = srcu_dereference(
- *slot,
- &pbundle->bundle.ufile->device->disassociate_srcu);
+ attr_uapi = rcu_dereference_protected(*slot, true);
if (attr_uapi->spec.type == UVERBS_ATTR_TYPE_IDRS_ARRAY) {
current_ret = uverbs_free_idrs_array(
@@ -542,7 +539,7 @@ static int ib_uverbs_cmd_verbs(struct ib_uverbs_file *ufile,
uapi_key_ioctl_method(hdr->method_id));
if (unlikely(!slot))
return -EPROTONOSUPPORT;
- method_elm = srcu_dereference(*slot, &ufile->device->disassociate_srcu);
+ method_elm = rcu_dereference_protected(*slot, true);
if (!method_elm->use_stack) {
pbundle = kmalloc(method_elm->bundle_size, GFP_KERNEL);