Re: [PATCH v3] IB/sa: Resolving use-after-free in ib_nl_send_msg

2020-06-21 Thread Leon Romanovsky
On Wed, Jun 17, 2020 at 03:23:00PM -0300, Jason Gunthorpe wrote: > On Wed, Jun 17, 2020 at 08:17:39AM +0300, Leon Romanovsky wrote: > > > > My thoughts that everything here hints me that state machine and > > locking are implemented wrongly. In ideal world, the expectation > > is that REQ message

Re: [PATCH v3] IB/sa: Resolving use-after-free in ib_nl_send_msg

2020-06-19 Thread Divya Indi
Hi Jason, Thanks for taking the time to review! On 6/17/20 11:24 AM, Jason Gunthorpe wrote: > On Tue, Jun 16, 2020 at 10:56:53AM -0700, Divya Indi wrote: >> The other option might be to use GFP_NOWAIT conditionally ie >> (only use GFP_NOWAIT when GFP_ATOMIC is not specified in gfp_mask else >>

Re: [PATCH v3] IB/sa: Resolving use-after-free in ib_nl_send_msg

2020-06-17 Thread Jason Gunthorpe
On Tue, Jun 16, 2020 at 10:56:53AM -0700, Divya Indi wrote: > The other option might be to use GFP_NOWAIT conditionally ie > (only use GFP_NOWAIT when GFP_ATOMIC is not specified in gfp_mask else > use GFP_ATOMIC). Eventual goal being to not have a blocking memory allocation. This is probably

Re: [PATCH v3] IB/sa: Resolving use-after-free in ib_nl_send_msg

2020-06-17 Thread Jason Gunthorpe
On Wed, Jun 17, 2020 at 08:17:39AM +0300, Leon Romanovsky wrote: > > My thoughts that everything here hints me that state machine and > locking are implemented wrongly. In ideal world, the expectation > is that REQ message will have a state in it (PREPARED, SENT, ACK > e.t.c.) and list

Re: [PATCH v3] IB/sa: Resolving use-after-free in ib_nl_send_msg

2020-06-16 Thread Leon Romanovsky
On Tue, Jun 16, 2020 at 10:56:53AM -0700, Divya Indi wrote: > Hi Leon, > > Please find my comments inline - > > On 6/13/20 11:41 PM, Leon Romanovsky wrote: > > On Tue, Jun 09, 2020 at 07:45:21AM -0700, Divya Indi wrote: > >> Hi Leon, > >> > >> Thanks for taking the time to review. > >> > >> Please

Re: [PATCH v3] IB/sa: Resolving use-after-free in ib_nl_send_msg

2020-06-16 Thread Divya Indi
Hi Leon, Please find my comments inline - On 6/13/20 11:41 PM, Leon Romanovsky wrote: > On Tue, Jun 09, 2020 at 07:45:21AM -0700, Divya Indi wrote: >> Hi Leon, >> >> Thanks for taking the time to review. >> >> Please find my comments inline - >> >> On 6/9/20 12:00 AM, Leon Romanovsky wrote: >>>

Re: [PATCH v3] IB/sa: Resolving use-after-free in ib_nl_send_msg

2020-06-14 Thread Leon Romanovsky
On Tue, Jun 09, 2020 at 07:45:21AM -0700, Divya Indi wrote: > Hi Leon, > > Thanks for taking the time to review. > > Please find my comments inline - > > On 6/9/20 12:00 AM, Leon Romanovsky wrote: > > On Mon, Jun 08, 2020 at 07:46:16AM -0700, Divya Indi wrote: > >> Commit 3ebd2fd0d011 ("IB/sa: Put

Re: [PATCH v3] IB/sa: Resolving use-after-free in ib_nl_send_msg

2020-06-09 Thread Divya Indi
Hi Leon, Thanks for taking the time to review. Please find my comments inline - On 6/9/20 12:00 AM, Leon Romanovsky wrote: > On Mon, Jun 08, 2020 at 07:46:16AM -0700, Divya Indi wrote: >> Commit 3ebd2fd0d011 ("IB/sa: Put netlink request into the request list >> before sending")' >> - >> 1.

Re: [PATCH v3] IB/sa: Resolving use-after-free in ib_nl_send_msg

2020-06-09 Thread Leon Romanovsky
On Mon, Jun 08, 2020 at 07:46:16AM -0700, Divya Indi wrote: > Commit 3ebd2fd0d011 ("IB/sa: Put netlink request into the request list before > sending")' > - > 1. Adds the query to the request list before ib_nl_snd_msg. > 2. Removes ib_nl_send_msg from within the spinlock which also makes it >

[PATCH v3] IB/sa: Resolving use-after-free in ib_nl_send_msg

2020-06-08 Thread Divya Indi
Commit 3ebd2fd0d011 ("IB/sa: Put netlink request into the request list before sending")' - 1. Adds the query to the request list before ib_nl_snd_msg. 2. Removes ib_nl_send_msg from within the spinlock which also makes it possible to allocate memory with GFP_KERNEL. However, if there is a delay