]> CyberLeo.Net >> Repos - FreeBSD/FreeBSD.git/commit
ibcore: Fix a race with disassociate and exit_mmap()
authorHans Petter Selasky <hselasky@FreeBSD.org>
Tue, 21 Jun 2022 09:23:55 +0000 (11:23 +0200)
committerHans Petter Selasky <hselasky@FreeBSD.org>
Tue, 21 Jun 2022 09:33:27 +0000 (11:33 +0200)
commit9fc6a635220fdd8a0a29de0a985a4a0c3a6890fd
treee5a4c6b7f7c24a681fe1480dae052c9d99543490
parent55d183367104e3efcdaa936f65e4f82303871271
ibcore: Fix a race with disassociate and exit_mmap()

If uverbs_user_mmap_disassociate() is called while the mmap is
concurrently doing exit_mmap then the ordering of the
rdma_user_mmap_entry_put() is not reliable.

The put must be done before uvers_user_mmap_disassociate() returns,
otherwise there can be a use after free on the ucontext, and a left over
entry in the xarray. If the put is not done here then it is done during
rdma_umap_close() later.

Add the missing put to the error exit path.

Linux commit:
39c011a538272589b9eb02ff1228af528522a22c

PR: 264473
MFC after: 3 days
Sponsored by: NVIDIA Networking
sys/ofed/drivers/infiniband/core/ib_uverbs_main.c