On 6/25/2015 8:52 PM, Jason Gunthorpe wrote:
On Thu, Jun 25, 2015 at 02:46:02PM +0300, Yishai Hadas wrote:
On 6/24/2015 8:57 PM, Jason Gunthorpe wrote:
On Mon, Jun 22, 2015 at 05:47:14PM +0300, Yishai Hadas wrote:
fd_install(resp.async_fd, filp);
@@ -386,6 +376,7 @@ ssize_t ib_uverbs_get_context(struct ib_uverbs_file *file,
return in_len;
err_file:
+ ib_uverbs_free_async_event_file(file);
fput(filp);
This looks really weird.
We need to cleanup all by that step otherwise we might leak that async file,
see my last comment below which clarifies that point.
As ib_uverbs_release_event_file is static function in uverbs_main it makes
sense to expose this cleanup function similar to ib_uverbs_alloc_event_file
which is exposed from uverbs_main and make the allocation.
Okay, sure, that makes sense.
Again again, WTF? async_file is a kref'd thing, if you copy or assign
to it you need to manipulate the kref, so the null assign should be
dropping the ref.
The logic in ib_uverbs_alloc_event_file if kref oriented, the original code
which uses free didn't follow this convention, currently in case
Yes, and you fixed it, this is good:
@@ -557,15 +563,38 @@ struct file *ib_uverbs_alloc_event_file(struct
ib_uverbs_file *uverbs_file,
ev_file = kmalloc(sizeof *ev_file, GFP_KERNEL);
kref_init(&ev_file->ref);
if (IS_ERR(filp))
+ goto err;
+err:
+ kref_put(&ev_file->ref, ib_uverbs_release_event_file);
The kref_init and the kref_put are a matching pair, great!
had an error after that the file was created (e.g ib_register_event_handler)
need to use fput(filp) to make an extra cleanup which again uses ref count
handling.
Yep, that is a good idea too. But understand what it means,
When this happens:
filp = anon_inode_getfile("[infinibandevent]", &uverbs_event_fops,
ev_file, O_RDONLY);
The unref pairs for these gets:
kref_init(&ev_file->ref);
+ kref_get(&uverbs_file->ref);
Are logically moved into flip, and now fput(flip) will call
ib_uverbs_event_close() and both those krefs will be released.
For this reason, for clarity, I would also move the
'kref_get(&uverbs_file->ref);' to be before anon_inode_getfile()
Taking kref_get(&uverbs_file->ref) before anon_inode_getfile has
succeeded is not correct, only when anon_inode_getfile succeeds we can
call fput(filp) which internally makes the kref_get on the uverbs_file
as part of ib_uverbs_event_close. In current code we take ref count on
the ev_file as part kref_init(&ev_file->ref) which is put as part of the
"err" label
err:
kref_put(&ev_file->ref, ib_uverbs_release_event_file);
In case anon_inode_getfile has succeeded we take also the ref_count on
the uverbs_file which will be put back upon closing the file and the
kref put/get are fully symmetric. For the async case we also fully
symmetric here, see next comment below.
Which means this:
@@ -557,15 +563,38 @@ struct file *ib_uverbs_alloc_event_file(struct
ib_uverbs_file *uverbs_file,
+ kref_get(&uverbs_file->ref);
+ if (is_async) {
+ if (ret)
+ goto put_file;
+put_file:
+ fput(filp);
+err:
+ kref_put(&ev_file->ref, ib_uverbs_release_event_file);
Is a double put on ev_file, since fput -> ib_uverbs_event_close does one, and
then err does another. (remember, the ref was moved into the flip)
Next:
+ if (is_async) {
+ uverbs_file->async_file = ev_file;
+ kref_get(&uverbs_file->async_file->ref);
+ if (ret)
+ goto put_file;
+put_file:
+ uverbs_file->async_file = NULL;
Where is the paired kref_put? There are two I can see:
+void ib_uverbs_free_async_event_file(struct ib_uverbs_file *file)
+{
+ kref_put(&file->async_file->ref, ib_uverbs_release_event_file);
-----
static int ib_uverbs_close(struct inode *inode, struct file *filp)
kref_put(&file->async_file->ref, ib_uverbs_release_event_file);
As far as I can tell, neither of these are called, so we have an
unbalanced put.
You are wrong here, we have here balanced put, the first is done as part
of fput(filp) -> ib_uverbs_event_close_file -> kref_put(&file->ref,
ib_uverbs_release_event_file) and the second at the end of this function
as part of the err: label kref_put(&ev_file->ref,
ib_uverbs_release_event_file);
So, as I reviewer, I see a kref'd variable (async_file) being
manipulated without corresponding kref code. I *KNOW* something is
wrong. You answer didn't address this, you needed to ID where the
pair'd kref_put was and justify having the '= NULL' so far away from
it.
See my comment above, we have here pair kref_put, the
uverbs_file->async_file = NULL comes to prevent a third in-correct
kref_put as part of ib_uverbs_close.
Please review and let me know whether you can ACK on this patch.
--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
