• Steve Wise's avatar
    RDMA/uverbs: Atomically flush and mark closed the comp event queue · 67e38168
    Steve Wise authored
    Currently a uverbs completion event queue is flushed of events in
    ib_uverbs_comp_event_close() with the queue spinlock held and then
    released.  Yet setting ev_queue->is_closed is not set until later in
    uverbs_hot_unplug_completion_event_file().
    
    In between the time ib_uverbs_comp_event_close() releases the lock and
    uverbs_hot_unplug_completion_event_file() acquires the lock, a completion
    event can arrive and be inserted into the event queue by
    ib_uverbs_comp_handler().
    
    This can cause a "double add" list_add warning or crash depending on the
    kernel configuration, or a memory leak because the event is never dequeued
    since the queue is already closed down.
    
    So add setting ev_queue->is_closed = 1 to ib_uverbs_comp_event_close().
    
    Cc: stable@vger.kernel.org
    Fixes: 1e7710f3 ("IB/core: Change completion channel to use the reworked objects schema")
    Signed-off-by: default avatarSteve Wise <swise@opengridcomputing.com>
    Signed-off-by: default avatarJason Gunthorpe <jgg@mellanox.com>
    67e38168
uverbs_main.c 35.1 KB