[Bug 264473] uverbs: Fix a race with disassociate and exit_mmap()

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=264473

            Bug ID: 264473
           Summary: uverbs: Fix a race with disassociate and exit_mmap()
           Product: Base System
           Version: Unspecified
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: kern
          Assignee: bugs@FreeBSD.org
          Reporter: ruc_gongyuanjun@163.com

Created attachment 234462
  --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=234462&action=edit
a possible patch

If uverbs_user_mmap_disassociate() is called while the mmap is
concurrently doing exit_mmap then the ordering of the
rdma_user_mmap_entry_put() is not reliable.
The put must be done before uvers_user_mmap_disassociate() returns,
otherwise there can be a use after free on the ucontext, and a left over
entry in the xarray. If the put is not done here then it is done during
rdma_umap_close() later.
Add the missing put to the error exit path.

-- 
You are receiving this mail because:
You are the assignee for the bug.