Patch "cxl: Fix leaking pid refs in some error paths" has been added to the 4.8-stable tree

PATCH [email protected] 1 participant 1 message Nov 7, 2016

Subsystems (2)

Stable branch Char and misc drivers

lore

Share & tools

lore

[email protected]

author maintainer Applied

2016-11-07 16:24 UTC #0 lore raw

This is a note to let you know that I've just added the patch titled

cxl: Fix leaking pid refs in some error paths

to the 4.8-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
cxl-fix-leaking-pid-refs-in-some-error-paths.patch
and it can be found in the queue-4.8 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

Quoted 1 line

From a05b82d5149dfeef05254a11c3636a89a854520a Mon Sep 17 00:00:00 2001

From: Vaibhav Jain <[email protected]>
Date: Fri, 21 Oct 2016 14:53:53 +0530
Subject: cxl: Fix leaking pid refs in some error paths

From: Vaibhav Jain <[email protected]>

commit a05b82d5149dfeef05254a11c3636a89a854520a upstream.

In some error paths in functions cxl_start_context and afu_ioctl_start_work pid references to the current & group-leader tasks can leak after they are taken. This patch fixes these error paths to release these pid references before exiting the error path.

Fixes 7b8ad495d592 ("cxl: Fix DSI misses when the context owning task exits")

Reviewed-by Andrew Donnellan <[email protected]>

Reported-by Frederic Barrat <[email protected]>

Signed-off-by Vaibhav Jain <[email protected]>

Acked-by Frederic Barrat <[email protected]>

Signed-off-by Michael Ellerman <[email protected]>

Signed-off-by Greg Kroah-Hartman <[email protected]>

---
 drivers/misc/cxl/api.c  |    2 ++
 drivers/misc/cxl/file.c |   22 +++++++++++++---------
 2 files changed, 15 insertions(+), 9 deletions(-)

drivers/misc/cxl/api.c +2 -0

@@ -247,7 +247,9 @@ int cxl_start_context(struct cxl_context
 	cxl_ctx_get();
 
 	if ((rc = cxl_ops->attach_process(ctx, kernel, wed, 0))) {
+		put_pid(ctx->glpid);
 		put_pid(ctx->pid);
+		ctx->glpid = ctx->pid = NULL;
 		cxl_adapter_context_put(ctx->afu->adapter);
 		cxl_ctx_put();
 		goto out;

drivers/misc/cxl/file.c +13 -9

@@ -194,6 +194,16 @@ static long afu_ioctl_start_work(struct
 	ctx->mmio_err_ff = !!(work.flags & CXL_START_WORK_ERR_FF);
 
 	/*
+	 * Increment the mapped context count for adapter. This also checks
+	 * if adapter_context_lock is taken.
+	 */
+	rc = cxl_adapter_context_get(ctx->afu->adapter);
+	if (rc) {
+		afu_release_irqs(ctx, ctx);
+		goto out;
+	}
+
+	/*
 	 * We grab the PID here and not in the file open to allow for the case
 	 * where a process (master, some daemon, etc) has opened the chardev on
 	 * behalf of another process, so the AFU's mm gets bound to the process

@@ -205,15 +215,6 @@ static long afu_ioctl_start_work(struct
 	ctx->pid = get_task_pid(current, PIDTYPE_PID);
 	ctx->glpid = get_task_pid(current->group_leader, PIDTYPE_PID);
 
-	/*
-	 * Increment the mapped context count for adapter. This also checks
-	 * if adapter_context_lock is taken.
-	 */
-	rc = cxl_adapter_context_get(ctx->afu->adapter);
-	if (rc) {
-		afu_release_irqs(ctx, ctx);
-		goto out;
-	}
 
 	trace_cxl_attach(ctx, work.work_element_descriptor, work.num_interrupts, amr);

@@ -221,6 +222,9 @@ static long afu_ioctl_start_work(struct
 							amr))) {
 		afu_release_irqs(ctx, ctx);
 		cxl_adapter_context_put(ctx->afu->adapter);
+		put_pid(ctx->glpid);
+		put_pid(ctx->pid);
+		ctx->glpid = ctx->pid = NULL;
 		goto out;
 	}

Patches currently in stable-queue which might be from [email protected] are

queue-4.8/cxl-fix-leaking-pid-refs-in-some-error-paths.patch