Skip site navigation (1)Skip section navigation (2)
Date:      Tue, 03 Mar 2020 13:40:34 +0000
From:      bugzilla-noreply@freebsd.org
To:        bugs@FreeBSD.org
Subject:   [Bug 244572] Resources leaked by linux_kpi when resetting RDMA device
Message-ID:  <bug-244572-227@https.bugs.freebsd.org/bugzilla/>

next in thread | raw e-mail | index | archive | help
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D244572

            Bug ID: 244572
           Summary: Resources leaked by linux_kpi when resetting RDMA
                    device
           Product: Base System
           Version: CURRENT
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Some People
          Priority: ---
         Component: kern
          Assignee: bugs@FreeBSD.org
          Reporter: aboyer@pensando.io

Created attachment 212118
  --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=3D212118&action=
=3Dedit
Proposed patch to linux_file_close()

If an RDMA driver resets itself by posting a NETDEV_UNREGISTER event while a
userspace process has the device open, cleanup will fail and unregister will
hang forever.

(This is admittedly an obscure corner case.)

This is what should happen when the process shuts down:
#2 0xffffffff80e9a4e6 at ib_destroy_qp+0xd6
#3 0xffffffff80e98ab0 at ib_uverbs_cleanup_ucontext+0x1e0
#4 0xffffffff80e9879c at ib_uverbs_close+0x6c
#5 0xffffffff80e45cda at linux_file_close+0x18a

The issue is that the uverbs file will be partially destroyed by the unregi=
ster
process, clearing the uverbs file's fops structure. Then, when the userspace
process shuts down, the uverbs file will be closed, but its ->release()
function (ib_uverbs_close() in this case) will not be called.

This leaks whatever RDMA data structures were in use by the process.

To fix the issue, change linux_file_close() to use the file pointer's embed=
ded
f_ops, rather than pulling them from the cdev. This allows cleanup to run e=
ven
after the cdev has been destroyed.

The attached patch has been tested on FreeBSD 11.3-RELEASE-p5 and
12.1-RELEASE-p1.

--=20
You are receiving this mail because:
You are the assignee for the bug.=



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-244572-227>