summary |
shortlog |
log |
commit | commitdiff |
tree
raw |
patch |
inline | side by side (from parent 1:
44dd823)
Al Viro pointed out that the current IB userspace verbs interface
allows userspace to cause mischief by closing file descriptors before
we're ready, or issuing the same command twice at the same time. This
patch closes those races, and fixes other obvious problems such as a
module reference leak.
Some other interface bogosities will require an ABI change to fix
properly, so I'm deferring those fixes until 2.6.15.
Signed-off-by: Roland Dreier <rolandd@cisco.com>
struct ib_uverbs_file {
struct kref ref;
struct ib_uverbs_file {
struct kref ref;
+ struct semaphore mutex;
struct ib_uverbs_device *device;
struct ib_ucontext *ucontext;
struct ib_event_handler event_handler;
struct ib_uverbs_device *device;
struct ib_ucontext *ucontext;
struct ib_event_handler event_handler;
struct ib_uverbs_get_context_resp resp;
struct ib_udata udata;
struct ib_device *ibdev = file->device->ib_dev;
struct ib_uverbs_get_context_resp resp;
struct ib_udata udata;
struct ib_device *ibdev = file->device->ib_dev;
+ struct ib_ucontext *ucontext;
if (out_len < sizeof resp)
return -ENOSPC;
if (out_len < sizeof resp)
return -ENOSPC;
if (copy_from_user(&cmd, buf, sizeof cmd))
return -EFAULT;
if (copy_from_user(&cmd, buf, sizeof cmd))
return -EFAULT;
+ down(&file->mutex);
+
+ if (file->ucontext) {
+ ret = -EINVAL;
+ goto err;
+ }
+
INIT_UDATA(&udata, buf + sizeof cmd,
(unsigned long) cmd.response + sizeof resp,
in_len - sizeof cmd, out_len - sizeof resp);
INIT_UDATA(&udata, buf + sizeof cmd,
(unsigned long) cmd.response + sizeof resp,
in_len - sizeof cmd, out_len - sizeof resp);
- file->ucontext = ibdev->alloc_ucontext(ibdev, &udata);
- if (IS_ERR(file->ucontext)) {
- ret = PTR_ERR(file->ucontext);
- file->ucontext = NULL;
- return ret;
- }
+ ucontext = ibdev->alloc_ucontext(ibdev, &udata);
+ if (IS_ERR(ucontext))
+ return PTR_ERR(file->ucontext);
- file->ucontext->device = ibdev;
- INIT_LIST_HEAD(&file->ucontext->pd_list);
- INIT_LIST_HEAD(&file->ucontext->mr_list);
- INIT_LIST_HEAD(&file->ucontext->mw_list);
- INIT_LIST_HEAD(&file->ucontext->cq_list);
- INIT_LIST_HEAD(&file->ucontext->qp_list);
- INIT_LIST_HEAD(&file->ucontext->srq_list);
- INIT_LIST_HEAD(&file->ucontext->ah_list);
- spin_lock_init(&file->ucontext->lock);
+ ucontext->device = ibdev;
+ INIT_LIST_HEAD(&ucontext->pd_list);
+ INIT_LIST_HEAD(&ucontext->mr_list);
+ INIT_LIST_HEAD(&ucontext->mw_list);
+ INIT_LIST_HEAD(&ucontext->cq_list);
+ INIT_LIST_HEAD(&ucontext->qp_list);
+ INIT_LIST_HEAD(&ucontext->srq_list);
+ INIT_LIST_HEAD(&ucontext->ah_list);
resp.async_fd = file->async_file.fd;
for (i = 0; i < file->device->num_comp; ++i)
if (copy_to_user((void __user *) (unsigned long) cmd.cq_fd_tab +
i * sizeof (__u32),
resp.async_fd = file->async_file.fd;
for (i = 0; i < file->device->num_comp; ++i)
if (copy_to_user((void __user *) (unsigned long) cmd.cq_fd_tab +
i * sizeof (__u32),
- &file->comp_file[i].fd, sizeof (__u32)))
- goto err;
+ &file->comp_file[i].fd, sizeof (__u32))) {
+ ret = -EFAULT;
+ goto err_free;
+ }
if (copy_to_user((void __user *) (unsigned long) cmd.response,
if (copy_to_user((void __user *) (unsigned long) cmd.response,
- &resp, sizeof resp))
- goto err;
+ &resp, sizeof resp)) {
+ ret = -EFAULT;
+ goto err_free;
+ }
+
+ file->ucontext = ucontext;
+ up(&file->mutex);
-err:
- ibdev->dealloc_ucontext(file->ucontext);
- file->ucontext = NULL;
+err_free:
+ ibdev->dealloc_ucontext(ucontext);
+err:
+ up(&file->mutex);
+ return ret;
}
ssize_t ib_uverbs_query_device(struct ib_uverbs_file *file,
}
ssize_t ib_uverbs_query_device(struct ib_uverbs_file *file,
- spin_lock_irq(&file->ucontext->lock);
list_add_tail(&uobj->list, &file->ucontext->pd_list);
list_add_tail(&uobj->list, &file->ucontext->pd_list);
- spin_unlock_irq(&file->ucontext->lock);
memset(&resp, 0, sizeof resp);
resp.pd_handle = uobj->id;
memset(&resp, 0, sizeof resp);
resp.pd_handle = uobj->id;
- spin_lock_irq(&file->ucontext->lock);
- spin_unlock_irq(&file->ucontext->lock);
down(&ib_uverbs_idr_mutex);
idr_remove(&ib_uverbs_pd_idr, uobj->id);
down(&ib_uverbs_idr_mutex);
idr_remove(&ib_uverbs_pd_idr, uobj->id);
idr_remove(&ib_uverbs_pd_idr, cmd.pd_handle);
idr_remove(&ib_uverbs_pd_idr, cmd.pd_handle);
- spin_lock_irq(&file->ucontext->lock);
- spin_unlock_irq(&file->ucontext->lock);
resp.mr_handle = obj->uobject.id;
resp.mr_handle = obj->uobject.id;
- spin_lock_irq(&file->ucontext->lock);
list_add_tail(&obj->uobject.list, &file->ucontext->mr_list);
list_add_tail(&obj->uobject.list, &file->ucontext->mr_list);
- spin_unlock_irq(&file->ucontext->lock);
if (copy_to_user((void __user *) (unsigned long) cmd.response,
&resp, sizeof resp)) {
if (copy_to_user((void __user *) (unsigned long) cmd.response,
&resp, sizeof resp)) {
- spin_lock_irq(&file->ucontext->lock);
list_del(&obj->uobject.list);
list_del(&obj->uobject.list);
- spin_unlock_irq(&file->ucontext->lock);
err_unreg:
ib_dereg_mr(mr);
err_unreg:
ib_dereg_mr(mr);
idr_remove(&ib_uverbs_mr_idr, cmd.mr_handle);
idr_remove(&ib_uverbs_mr_idr, cmd.mr_handle);
- spin_lock_irq(&file->ucontext->lock);
list_del(&memobj->uobject.list);
list_del(&memobj->uobject.list);
- spin_unlock_irq(&file->ucontext->lock);
ib_umem_release(file->device->ib_dev, &memobj->umem);
kfree(memobj);
ib_umem_release(file->device->ib_dev, &memobj->umem);
kfree(memobj);
- spin_lock_irq(&file->ucontext->lock);
list_add_tail(&uobj->uobject.list, &file->ucontext->cq_list);
list_add_tail(&uobj->uobject.list, &file->ucontext->cq_list);
- spin_unlock_irq(&file->ucontext->lock);
memset(&resp, 0, sizeof resp);
resp.cq_handle = uobj->uobject.id;
memset(&resp, 0, sizeof resp);
resp.cq_handle = uobj->uobject.id;
- spin_lock_irq(&file->ucontext->lock);
list_del(&uobj->uobject.list);
list_del(&uobj->uobject.list);
- spin_unlock_irq(&file->ucontext->lock);
down(&ib_uverbs_idr_mutex);
idr_remove(&ib_uverbs_cq_idr, uobj->uobject.id);
down(&ib_uverbs_idr_mutex);
idr_remove(&ib_uverbs_cq_idr, uobj->uobject.id);
idr_remove(&ib_uverbs_cq_idr, cmd.cq_handle);
idr_remove(&ib_uverbs_cq_idr, cmd.cq_handle);
- spin_lock_irq(&file->ucontext->lock);
list_del(&uobj->uobject.list);
list_del(&uobj->uobject.list);
- spin_unlock_irq(&file->ucontext->lock);
spin_lock_irq(&file->comp_file[0].lock);
list_for_each_entry_safe(evt, tmp, &uobj->comp_list, obj_list) {
spin_lock_irq(&file->comp_file[0].lock);
list_for_each_entry_safe(evt, tmp, &uobj->comp_list, obj_list) {
resp.qp_handle = uobj->uobject.id;
resp.qp_handle = uobj->uobject.id;
- spin_lock_irq(&file->ucontext->lock);
list_add_tail(&uobj->uobject.list, &file->ucontext->qp_list);
list_add_tail(&uobj->uobject.list, &file->ucontext->qp_list);
- spin_unlock_irq(&file->ucontext->lock);
if (copy_to_user((void __user *) (unsigned long) cmd.response,
&resp, sizeof resp)) {
if (copy_to_user((void __user *) (unsigned long) cmd.response,
&resp, sizeof resp)) {
- spin_lock_irq(&file->ucontext->lock);
list_del(&uobj->uobject.list);
list_del(&uobj->uobject.list);
- spin_unlock_irq(&file->ucontext->lock);
err_destroy:
ib_destroy_qp(qp);
err_destroy:
ib_destroy_qp(qp);
idr_remove(&ib_uverbs_qp_idr, cmd.qp_handle);
idr_remove(&ib_uverbs_qp_idr, cmd.qp_handle);
- spin_lock_irq(&file->ucontext->lock);
list_del(&uobj->uobject.list);
list_del(&uobj->uobject.list);
- spin_unlock_irq(&file->ucontext->lock);
spin_lock_irq(&file->async_file.lock);
list_for_each_entry_safe(evt, tmp, &uobj->event_list, obj_list) {
spin_lock_irq(&file->async_file.lock);
list_for_each_entry_safe(evt, tmp, &uobj->event_list, obj_list) {
resp.srq_handle = uobj->uobject.id;
resp.srq_handle = uobj->uobject.id;
- spin_lock_irq(&file->ucontext->lock);
list_add_tail(&uobj->uobject.list, &file->ucontext->srq_list);
list_add_tail(&uobj->uobject.list, &file->ucontext->srq_list);
- spin_unlock_irq(&file->ucontext->lock);
if (copy_to_user((void __user *) (unsigned long) cmd.response,
&resp, sizeof resp)) {
if (copy_to_user((void __user *) (unsigned long) cmd.response,
&resp, sizeof resp)) {
- spin_lock_irq(&file->ucontext->lock);
list_del(&uobj->uobject.list);
list_del(&uobj->uobject.list);
- spin_unlock_irq(&file->ucontext->lock);
err_destroy:
ib_destroy_srq(srq);
err_destroy:
ib_destroy_srq(srq);
idr_remove(&ib_uverbs_srq_idr, cmd.srq_handle);
idr_remove(&ib_uverbs_srq_idr, cmd.srq_handle);
- spin_lock_irq(&file->ucontext->lock);
list_del(&uobj->uobject.list);
list_del(&uobj->uobject.list);
- spin_unlock_irq(&file->ucontext->lock);
spin_lock_irq(&file->async_file.lock);
list_for_each_entry_safe(evt, tmp, &uobj->event_list, obj_list) {
spin_lock_irq(&file->async_file.lock);
list_for_each_entry_safe(evt, tmp, &uobj->event_list, obj_list) {
if (hdr.in_words * 4 != count)
return -EINVAL;
if (hdr.in_words * 4 != count)
return -EINVAL;
- if (hdr.command < 0 || hdr.command >= ARRAY_SIZE(uverbs_cmd_table))
+ if (hdr.command < 0 ||
+ hdr.command >= ARRAY_SIZE(uverbs_cmd_table) ||
+ !uverbs_cmd_table[hdr.command])
return -EINVAL;
if (!file->ucontext &&
return -EINVAL;
if (!file->ucontext &&
file = kmalloc(sizeof *file +
(dev->num_comp - 1) * sizeof (struct ib_uverbs_event_file),
GFP_KERNEL);
file = kmalloc(sizeof *file +
(dev->num_comp - 1) * sizeof (struct ib_uverbs_event_file),
GFP_KERNEL);
- if (!file)
- return -ENOMEM;
+ if (!file) {
+ ret = -ENOMEM;
+ goto err;
+ }
file->device = dev;
kref_init(&file->ref);
file->device = dev;
kref_init(&file->ref);
+ init_MUTEX(&file->mutex);
ret = ib_uverbs_event_init(&file->async_file, file);
if (ret)
ret = ib_uverbs_event_init(&file->async_file, file);
if (ret)
file->async_file.is_async = 1;
file->async_file.is_async = 1;
- kref_get(&file->ref);
-
for (i = 0; i < dev->num_comp; ++i) {
for (i = 0; i < dev->num_comp; ++i) {
ret = ib_uverbs_event_init(&file->comp_file[i], file);
if (ret)
goto err_async;
ret = ib_uverbs_event_init(&file->comp_file[i], file);
if (ret)
goto err_async;
file->comp_file[i].is_async = 0;
}
file->comp_file[i].is_async = 0;
}
ib_uverbs_event_release(&file->async_file);
ib_uverbs_event_release(&file->async_file);
+err_kref:
+ /*
+ * One extra kref_put() because we took a reference before the
+ * event file creation that failed and got us here.
+ */
+ kref_put(&file->ref, ib_uverbs_release_file);
kref_put(&file->ref, ib_uverbs_release_file);
kref_put(&file->ref, ib_uverbs_release_file);
+err:
+ module_put(dev->ib_dev->owner);
struct list_head qp_list;
struct list_head srq_list;
struct list_head ah_list;
struct list_head qp_list;
struct list_head srq_list;
struct list_head ah_list;