提交 418edaab 编写于 作者: T Tatyana Nikolova 提交者: Roland Dreier

RDMA/ucma.c: Fix for events with wrong context on iWARP

It is possible for asynchronous RDMA_CM_EVENT_ESTABLISHED events to be
generated with ctx->uid == 0, because ucma_set_event_context() copies
ctx->uid to the event structure outside of ctx->file->mut.  This leads
to a crash in the userspace library, since it gets a bogus event.

Fix this by taking the mutex a bit earlier in ucma_event_handler.
Signed-off-by: NTatyana Nikolova <Tatyana.E.Nikolova@intel.com>
Signed-off-by: NSean Hefty <Sean.Hefty@intel.com>
Signed-off-by: NRoland Dreier <roland@purestorage.com>
上级 0d7614f0
...@@ -267,6 +267,7 @@ static int ucma_event_handler(struct rdma_cm_id *cm_id, ...@@ -267,6 +267,7 @@ static int ucma_event_handler(struct rdma_cm_id *cm_id,
if (!uevent) if (!uevent)
return event->event == RDMA_CM_EVENT_CONNECT_REQUEST; return event->event == RDMA_CM_EVENT_CONNECT_REQUEST;
mutex_lock(&ctx->file->mut);
uevent->cm_id = cm_id; uevent->cm_id = cm_id;
ucma_set_event_context(ctx, event, uevent); ucma_set_event_context(ctx, event, uevent);
uevent->resp.event = event->event; uevent->resp.event = event->event;
...@@ -277,7 +278,6 @@ static int ucma_event_handler(struct rdma_cm_id *cm_id, ...@@ -277,7 +278,6 @@ static int ucma_event_handler(struct rdma_cm_id *cm_id,
ucma_copy_conn_event(&uevent->resp.param.conn, ucma_copy_conn_event(&uevent->resp.param.conn,
&event->param.conn); &event->param.conn);
mutex_lock(&ctx->file->mut);
if (event->event == RDMA_CM_EVENT_CONNECT_REQUEST) { if (event->event == RDMA_CM_EVENT_CONNECT_REQUEST) {
if (!ctx->backlog) { if (!ctx->backlog) {
ret = -ENOMEM; ret = -ENOMEM;
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册