On 7/28/2023 8:45 AM, Zheng Zhang wrote:
> *External email: Use caution opening links or attachments*
>
>
> Jason, Leon, Mark Zhang, Mark Bloch and to whom it may concern:
>
> Hello! We have found a bug in the Linux kernel version 6.2.0 by
> Syzkaller with our own templates. In the call trace it invoked the rdma
> driver, thus we think it may be different from the reported case invoked
> io_ring whose fix is also in the io_ring module.
> Unfortunately, it doesn't generate a reproducer.
>
> Attached is the report, log generated by syzkaller.
> Please let me know if there is any additional information that I can
> provide to help debug this issue.
> Thanks!
> Best
> zheng
>
Hi Zheng,
Thank you very much for reporting. Is it easy to reproduce? Can you
please help test with this patch, thanks:
diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index 1ee87c3aaeab..76810aac1809 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -3491,11 +3491,13 @@ static void addr_handler(int status, struct
sockaddr *src_addr,
event.event = RDMA_CM_EVENT_ADDR_RESOLVED;
if (cma_cm_event_handler(id_priv, &event)) {
+ cma_id_put(id_priv);
destroy_id_handler_unlock(id_priv);
return;
}
out:
mutex_unlock(&id_priv->handler_mutex);
+ cma_id_put(id_priv);
}
static int cma_resolve_loopback(struct rdma_id_private *id_priv)
@@ -4107,6 +4109,9 @@ int rdma_resolve_addr(struct rdma_cm_id *id,
struct sockaddr *src_addr,
rdma_addr_cancel(&id->route.addr.dev_addr);
else
id_priv->used_resolve_ip = 1;
+
+ /* Balances with cma_id_put() in addr_handler */
+ cma_id_get(id_priv);
ret = rdma_resolve_ip(cma_src_addr(id_priv), dst_addr,
&id->route.addr.dev_addr,
timeout_ms, addr_handler,