diff mbox series

[1/1] RDMA/srpt: Do not register event handler until srpt device is fully setup

Message ID 20240131062438.869370-2-william.kucharski@oracle.com
State New
Headers
Series RDMA/srpt: Do not register event handler until srpt device is fully setup |

Commit Message

William Kucharski Jan. 31, 2024, 6:24 a.m. UTC 
  Upon rare occasions, KASAN reports a use-after-free Write
in srpt_refresh_port().

This seems to be because an event handler is registered before the
srpt device is fully setup and a race condition upon error may leave a
partially setup event handler in place.

Instead, only register the event handler after srpt device initialization
is complete.

Signed-off-by: William Kucharski <william.kucharski@oracle.com>
---
 drivers/infiniband/ulp/srpt/ib_srpt.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

Comments

Bart Van Assche Feb. 1, 2024, 2:48 p.m. UTC | #1 
On 1/30/24 22:24, William Kucharski wrote:
> Upon rare occasions, KASAN reports a use-after-free Write
> in srpt_refresh_port().
> 
> This seems to be because an event handler is registered before the
> srpt device is fully setup and a race condition upon error may leave a
> partially setup event handler in place.
> 
> Instead, only register the event handler after srpt device initialization
> is complete.

A Fixes: tag is missing. Otherwise this patch looks good to me. Hence:

Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Leon Romanovsky Feb. 4, 2024, 9:44 a.m. UTC | #2 
On Thu, Feb 01, 2024 at 06:48:34AM -0800, Bart Van Assche wrote:
> On 1/30/24 22:24, William Kucharski wrote:
> > Upon rare occasions, KASAN reports a use-after-free Write
> > in srpt_refresh_port().
> > 
> > This seems to be because an event handler is registered before the
> > srpt device is fully setup and a race condition upon error may leave a
> > partially setup event handler in place.
> > 
> > Instead, only register the event handler after srpt device initialization
> > is complete.
> 
> A Fixes: tag is missing. Otherwise this patch looks good to me. Hence:

I added this line:
Fixes: a42d985bd5b2 ("ib_srpt: Initial SRP Target merge for v3.3-rc1")

> 
> Reviewed-by: Bart Van Assche <bvanassche@acm.org>

Thanks
diff mbox series

Patch

diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
index 58f70cfec45a..d35f021f154b 100644
--- a/drivers/infiniband/ulp/srpt/ib_srpt.c
+++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
@@ -3204,7 +3204,6 @@  static int srpt_add_one(struct ib_device *device)
 
 	INIT_IB_EVENT_HANDLER(&sdev->event_handler, sdev->device,
 			      srpt_event_handler);
-	ib_register_event_handler(&sdev->event_handler);
 
 	for (i = 1; i <= sdev->device->phys_port_cnt; i++) {
 		sport = &sdev->port[i - 1];
@@ -3227,6 +3226,7 @@  static int srpt_add_one(struct ib_device *device)
 		}
 	}
 
+	ib_register_event_handler(&sdev->event_handler);
 	spin_lock(&srpt_dev_lock);
 	list_add_tail(&sdev->list, &srpt_dev_list);
 	spin_unlock(&srpt_dev_lock);
@@ -3237,7 +3237,6 @@  static int srpt_add_one(struct ib_device *device)
 
 err_port:
 	srpt_unregister_mad_agent(sdev, i);
-	ib_unregister_event_handler(&sdev->event_handler);
 err_cm:
 	if (sdev->cm_id)
 		ib_destroy_cm_id(sdev->cm_id);