RDMA/hfi1: Fix use-after-free bug for mm struct
authorDouglas Miller <doug.miller@cornelisnetworks.com>
Fri, 8 Apr 2022 13:35:23 +0000 (09:35 -0400)
committerJason Gunthorpe <jgg@nvidia.com>
Fri, 8 Apr 2022 18:40:06 +0000 (15:40 -0300)
commit2bbac98d0930e8161b1957dc0ec99de39ade1b3c
tree55c9b2381d8313681ee4d9d1492a2fd3b8776230
parent4d809f69695d4e7d1378b3a072fa9aef23123018
RDMA/hfi1: Fix use-after-free bug for mm struct

Under certain conditions, such as MPI_Abort, the hfi1 cleanup code may
represent the last reference held on the task mm.
hfi1_mmu_rb_unregister() then drops the last reference and the mm is freed
before the final use in hfi1_release_user_pages().  A new task may
allocate the mm structure while it is still being used, resulting in
problems. One manifestation is corruption of the mmap_sem counter leading
to a hang in down_write().  Another is corruption of an mm struct that is
in use by another task.

Fixes: 3d2a9d642512 ("IB/hfi1: Ensure correct mm is used at all times")
Link: https://lore.kernel.org/r/20220408133523.122165.72975.stgit@awfm-01.cornelisnetworks.com
Cc: <stable@vger.kernel.org>
Signed-off-by: Douglas Miller <doug.miller@cornelisnetworks.com>
Signed-off-by: Dennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
drivers/infiniband/hw/hfi1/mmu_rb.c