IB/hfi1: Fix potential use-after-free in PIO and SDMA map teardown

Browse source

The current teardown logic for dd->pio_map and dd->sdma_map frees the
structures while they might still be accessed by RCU readers. Although the
pointer is nulled under a spinlock, the memory is reclaimed before waiting
for the grace period to end.

This patch fixes the sequence by:
1. Extracting the pointer under the lock.
2. Clearing the RCU-protected pointer.
3. Waiting for readers to finish with synchronize_rcu().
4. Finally freeing the memory.

Fixes: 7724105686 ("IB/hfi1: add driver files")
Link: https://patch.msgid.link/r/20260206050836.5890-1-lirongqing@baidu.com
Signed-off-by: Li RongQing <lirongqing@baidu.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>

...

This commit is contained in:

Li RongQing 2026-02-06 00:08:36 -05:00 • committed by Jason Gunthorpe

parent 254f49634e

commit 76b48a70b1

2 changed files with 7 additions and 2 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

5

drivers/infiniband/hw/hfi1/pio.c

View file

4

drivers/infiniband/hw/hfi1/sdma.c

View file