diff mbox

cxl: Fix struct pid leak when attaching a process through user API

Message ID 1446552832-17592-1-git-send-email-fbarrat@linux.vnet.ibm.com (mailing list archive)
State Changes Requested
Headers show

Commit Message

Frederic Barrat Nov. 3, 2015, 12:13 p.m. UTC
When the cxl driver creates a context, it stores the pid of the
calling task, and mistakenly increments the reference count of the
struct pid twice, once through get_task_pid(), once through
get_pid(). The reference count is only decremented once on detach. As
a result, a struct pid is leaked and it reduces the number of
processes that can run simultaneously by one.
The fix is to simply remove the call to get_pid().

There is a separate patch for the kernel API, since it goes to
different kernel versions.

Signed-off-by: Frederic Barrat <fbarrat@linux.vnet.ibm.com>
Cc: <stable@vger.kernel.org> # 3.18+
---
 drivers/misc/cxl/file.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Ian Munsie Nov. 3, 2015, 10:25 p.m. UTC | #1
Acked-by: Ian Munsie <imunsie@au1.ibm.com>
Andrew Donnellan Nov. 3, 2015, 10:45 p.m. UTC | #2
On 03/11/15 23:13, Frederic Barrat wrote:
> When the cxl driver creates a context, it stores the pid of the
> calling task, and mistakenly increments the reference count of the
> struct pid twice, once through get_task_pid(), once through
> get_pid(). The reference count is only decremented once on detach. As
> a result, a struct pid is leaked and it reduces the number of
> processes that can run simultaneously by one.
> The fix is to simply remove the call to get_pid().
>
> There is a separate patch for the kernel API, since it goes to
> different kernel versions.
>
> Signed-off-by: Frederic Barrat <fbarrat@linux.vnet.ibm.com>
> Cc: <stable@vger.kernel.org> # 3.18+

Reviewed-by: Andrew Donnellan <andrew.donnellan@au1.ibm.com>
Michael Ellerman Jan. 26, 2016, 3:11 a.m. UTC | #3
On Tue, 2015-03-11 at 12:13:52 UTC, Frederic Barrat wrote:
> When the cxl driver creates a context, it stores the pid of the
> calling task, and mistakenly increments the reference count of the
> struct pid twice, once through get_task_pid(), once through
> get_pid(). The reference count is only decremented once on detach. As
> a result, a struct pid is leaked and it reduces the number of
> processes that can run simultaneously by one.
> The fix is to simply remove the call to get_pid().
> 
> There is a separate patch for the kernel API, since it goes to
> different kernel versions.
> 
> Signed-off-by: Frederic Barrat <fbarrat@linux.vnet.ibm.com>
> Cc: <stable@vger.kernel.org> # 3.18+
> Acked-by: Ian Munsie <imunsie@au1.ibm.com>
> Reviewed-by: Andrew Donnellan <andrew.donnellan@au1.ibm.com>

This no longer applies, since we merged 7b8ad495d592 ("cxl: Fix DSI misses when
the context owning task exits").

Please resend if it's still applicable.

cheers
Frederic Barrat Jan. 26, 2016, 8:16 a.m. UTC | #4
Le 26/01/2016 04:11, Michael Ellerman a écrit :
> This no longer applies, since we merged 7b8ad495d592 ("cxl: Fix DSI misses when
> the context owning task exits").

Yes, on 4.5, it has been superseded by 7b8ad495d592.
It may still be worth considering for stable releases though.

   Fred
diff mbox

Patch

diff --git a/drivers/misc/cxl/file.c b/drivers/misc/cxl/file.c
index 7ccd299..97003ee 100644
--- a/drivers/misc/cxl/file.c
+++ b/drivers/misc/cxl/file.c
@@ -199,7 +199,7 @@  static long afu_ioctl_start_work(struct cxl_context *ctx,
 	 * behalf of another process, so the AFU's mm gets bound to the process
 	 * that performs this ioctl and not the process that opened the file.
 	 */
-	ctx->pid = get_pid(get_task_pid(current, PIDTYPE_PID));
+	ctx->pid = get_task_pid(current, PIDTYPE_PID);
 
 	trace_cxl_attach(ctx, work.work_element_descriptor, work.num_interrupts, amr);