Commit b8f42738 authored by Michael J. Ruhl's avatar Michael J. Ruhl Committed by Doug Ledford

IB/hfi1: On error, fix use after free during user context setup

During base context setup, if setup_base_ctxt() fails, the context is
deallocated. This is incorrect because the context is referenced on
return, to notify any waiting subcontext.  If there are no subcontexts
the pointer will be invalid.

Reorganize the error path so that deallocate_ctxt() is called after all
the possible subcontexts have been notified.
Reviewed-by: default avatarIra Weiny <ira.weiny@intel.com>
Signed-off-by: default avatarMichael J. Ruhl <michael.j.ruhl@intel.com>
Signed-off-by: default avatarDennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
parent 612601d0
...@@ -930,15 +930,8 @@ static int assign_ctxt(struct hfi1_filedata *fd, struct hfi1_user_info *uinfo) ...@@ -930,15 +930,8 @@ static int assign_ctxt(struct hfi1_filedata *fd, struct hfi1_user_info *uinfo)
switch (ret) { switch (ret) {
case 0: case 0:
ret = setup_base_ctxt(fd, uctxt); ret = setup_base_ctxt(fd, uctxt);
if (uctxt->subctxt_cnt) { if (ret)
/* deallocate_ctxt(uctxt);
* Base context is done (successfully or not), notify
* anybody using a sub-context that is waiting for
* this completion.
*/
clear_bit(HFI1_CTXT_BASE_UNINIT, &uctxt->event_flags);
wake_up(&uctxt->wait);
}
break; break;
case 1: case 1:
ret = complete_subctxt(fd); ret = complete_subctxt(fd);
...@@ -1305,25 +1298,25 @@ static int setup_base_ctxt(struct hfi1_filedata *fd, ...@@ -1305,25 +1298,25 @@ static int setup_base_ctxt(struct hfi1_filedata *fd,
/* Now allocate the RcvHdr queue and eager buffers. */ /* Now allocate the RcvHdr queue and eager buffers. */
ret = hfi1_create_rcvhdrq(dd, uctxt); ret = hfi1_create_rcvhdrq(dd, uctxt);
if (ret) if (ret)
return ret; goto done;
ret = hfi1_setup_eagerbufs(uctxt); ret = hfi1_setup_eagerbufs(uctxt);
if (ret) if (ret)
goto setup_failed; goto done;
/* If sub-contexts are enabled, do the appropriate setup */ /* If sub-contexts are enabled, do the appropriate setup */
if (uctxt->subctxt_cnt) if (uctxt->subctxt_cnt)
ret = setup_subctxt(uctxt); ret = setup_subctxt(uctxt);
if (ret) if (ret)
goto setup_failed; goto done;
ret = hfi1_alloc_ctxt_rcv_groups(uctxt); ret = hfi1_alloc_ctxt_rcv_groups(uctxt);
if (ret) if (ret)
goto setup_failed; goto done;
ret = init_user_ctxt(fd, uctxt); ret = init_user_ctxt(fd, uctxt);
if (ret) if (ret)
goto setup_failed; goto done;
user_init(uctxt); user_init(uctxt);
...@@ -1331,12 +1324,22 @@ static int setup_base_ctxt(struct hfi1_filedata *fd, ...@@ -1331,12 +1324,22 @@ static int setup_base_ctxt(struct hfi1_filedata *fd,
fd->uctxt = uctxt; fd->uctxt = uctxt;
hfi1_rcd_get(uctxt); hfi1_rcd_get(uctxt);
return 0; done:
if (uctxt->subctxt_cnt) {
/*
* On error, set the failed bit so sub-contexts will clean up
* correctly.
*/
if (ret)
set_bit(HFI1_CTXT_BASE_FAILED, &uctxt->event_flags);
setup_failed: /*
/* Set the failed bit so sub-context init can do the right thing */ * Base context is done (successfully or not), notify anybody
set_bit(HFI1_CTXT_BASE_FAILED, &uctxt->event_flags); * using a sub-context that is waiting for this completion.
deallocate_ctxt(uctxt); */
clear_bit(HFI1_CTXT_BASE_UNINIT, &uctxt->event_flags);
wake_up(&uctxt->wait);
}
return ret; return ret;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment