mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-27 19:29:37 +00:00
RDMA/ucma.c: Fix for events with wrong context on iWARP
It is possible for asynchronous RDMA_CM_EVENT_ESTABLISHED events to be generated with ctx->uid == 0, because ucma_set_event_context() copies ctx->uid to the event structure outside of ctx->file->mut. This leads to a crash in the userspace library, since it gets a bogus event. Fix this by taking the mutex a bit earlier in ucma_event_handler. Signed-off-by: Tatyana Nikolova <Tatyana.E.Nikolova@intel.com> Signed-off-by: Sean Hefty <Sean.Hefty@intel.com> Signed-off-by: Roland Dreier <roland@purestorage.com>
This commit is contained in:
parent
0d7614f09c
commit
418edaaba9
1 changed files with 1 additions and 1 deletions
|
@ -267,6 +267,7 @@ static int ucma_event_handler(struct rdma_cm_id *cm_id,
|
||||||
if (!uevent)
|
if (!uevent)
|
||||||
return event->event == RDMA_CM_EVENT_CONNECT_REQUEST;
|
return event->event == RDMA_CM_EVENT_CONNECT_REQUEST;
|
||||||
|
|
||||||
|
mutex_lock(&ctx->file->mut);
|
||||||
uevent->cm_id = cm_id;
|
uevent->cm_id = cm_id;
|
||||||
ucma_set_event_context(ctx, event, uevent);
|
ucma_set_event_context(ctx, event, uevent);
|
||||||
uevent->resp.event = event->event;
|
uevent->resp.event = event->event;
|
||||||
|
@ -277,7 +278,6 @@ static int ucma_event_handler(struct rdma_cm_id *cm_id,
|
||||||
ucma_copy_conn_event(&uevent->resp.param.conn,
|
ucma_copy_conn_event(&uevent->resp.param.conn,
|
||||||
&event->param.conn);
|
&event->param.conn);
|
||||||
|
|
||||||
mutex_lock(&ctx->file->mut);
|
|
||||||
if (event->event == RDMA_CM_EVENT_CONNECT_REQUEST) {
|
if (event->event == RDMA_CM_EVENT_CONNECT_REQUEST) {
|
||||||
if (!ctx->backlog) {
|
if (!ctx->backlog) {
|
||||||
ret = -ENOMEM;
|
ret = -ENOMEM;
|
||||||
|
|
Loading…
Reference in a new issue