RDMA/addr: Fix race with netevent_callback()/rdma_addr_cancel()
authorJason Gunthorpe <jgg@nvidia.com>
Wed, 30 Sep 2020 07:20:07 +0000 (10:20 +0300)
committerJason Gunthorpe <jgg@nvidia.com>
Wed, 30 Sep 2020 18:29:05 +0000 (15:29 -0300)
commit2ee9bf346fbfd1dad0933b9eb3a4c2c0979b633e
treeccbbd29af7273de37e0e17a525637cacadf8d8bf
parenta6f0b08dbaf289c3c57284e16ac8043140f2139b
RDMA/addr: Fix race with netevent_callback()/rdma_addr_cancel()

This three thread race can result in the work being run once the callback
becomes NULL:

       CPU1                 CPU2                   CPU3
 netevent_callback()
                     process_one_req()       rdma_addr_cancel()
                      [..]
     spin_lock_bh()
   set_timeout()
     spin_unlock_bh()

spin_lock_bh()
list_del_init(&req->list);
spin_unlock_bh()

     req->callback = NULL
     spin_lock_bh()
       if (!list_empty(&req->list))
                         // Skipped!
         // cancel_delayed_work(&req->work);
     spin_unlock_bh()

    process_one_req() // again
     req->callback() // BOOM
cancel_delayed_work_sync()

The solution is to always cancel the work once it is completed so any
in between set_timeout() does not result in it running again.

Cc: stable@vger.kernel.org
Fixes: 44e75052bc2a ("RDMA/rdma_cm: Make rdma_addr_cancel into a fence")
Link: https://lore.kernel.org/r/20200930072007.1009692-1-leon@kernel.org
Reported-by: Dan Aloni <dan@kernelim.com>
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
drivers/infiniband/core/addr.c