| Message ID | 20210322161325.7491-1-lyl2019@mail.ustc.edu.cn (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [v2] infiniband: Fix a use after free in isert_connect_request | expand |
Acked-by: Sagi Grimberg <sagi@grimberg.me>
On Mon, Mar 22, 2021 at 09:13:25AM -0700, Lv Yunlong wrote: > The device is got by isert_device_get() with refcount is 1, > and is assigned to isert_conn by isert_conn->device = device. > When isert_create_qp() failed, device will be freed with > isert_device_put(). > > Later, the device is used in isert_free_login_buf(isert_conn) > by the isert_conn->device->ib_device statement. This patch > free the device in the correct order. > > Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn> > --- > drivers/infiniband/ulp/isert/ib_isert.c | 16 ++++++++-------- > 1 file changed, 8 insertions(+), 8 deletions(-) > Thanks, Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
On 3/22/2021 6:13 PM, Lv Yunlong wrote: > The device is got by isert_device_get() with refcount is 1, > and is assigned to isert_conn by isert_conn->device = device. > When isert_create_qp() failed, device will be freed with > isert_device_put(). > > Later, the device is used in isert_free_login_buf(isert_conn) > by the isert_conn->device->ib_device statement. This patch > free the device in the correct order. > > Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn> > --- > drivers/infiniband/ulp/isert/ib_isert.c | 16 ++++++++-------- > 1 file changed, 8 insertions(+), 8 deletions(-) looks good, Reviewed-by: Max Gurtovoy <mgurtovoy@nvidia.com>
On Mon, Mar 22, 2021 at 09:13:25AM -0700, Lv Yunlong wrote: > The device is got by isert_device_get() with refcount is 1, > and is assigned to isert_conn by isert_conn->device = device. > When isert_create_qp() failed, device will be freed with > isert_device_put(). > > Later, the device is used in isert_free_login_buf(isert_conn) > by the isert_conn->device->ib_device statement. This patch > free the device in the correct order. > > Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn> > Acked-by: Sagi Grimberg <sagi@grimberg.me> > Reviewed-by: Leon Romanovsky <leonro@nvidia.com> > Reviewed-by: Max Gurtovoy <mgurtovoy@nvidia.com> > drivers/infiniband/ulp/isert/ib_isert.c | 16 ++++++++-------- > 1 file changed, 8 insertions(+), 8 deletions(-) Applied to for-next, I added Fixes: ae9ea9ed38c9 ("iser-target: Split some logic in isert_connect_request to routines") Please ensure you add fixes lines when you send bug fixes. Thanks, Jason
diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c index 7305ed8976c2..18266f07c58d 100644 --- a/drivers/infiniband/ulp/isert/ib_isert.c +++ b/drivers/infiniband/ulp/isert/ib_isert.c @@ -438,23 +438,23 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event) isert_init_conn(isert_conn); isert_conn->cm_id = cma_id; - ret = isert_alloc_login_buf(isert_conn, cma_id->device); - if (ret) - goto out; - device = isert_device_get(cma_id); if (IS_ERR(device)) { ret = PTR_ERR(device); - goto out_rsp_dma_map; + goto out; } isert_conn->device = device; + ret = isert_alloc_login_buf(isert_conn, cma_id->device); + if (ret) + goto out_conn_dev; + isert_set_nego_params(isert_conn, &event->param.conn); isert_conn->qp = isert_create_qp(isert_conn, cma_id); if (IS_ERR(isert_conn->qp)) { ret = PTR_ERR(isert_conn->qp); - goto out_conn_dev; + goto out_rsp_dma_map; } ret = isert_login_post_recv(isert_conn); @@ -473,10 +473,10 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event) out_destroy_qp: isert_destroy_qp(isert_conn); -out_conn_dev: - isert_device_put(device); out_rsp_dma_map: isert_free_login_buf(isert_conn); +out_conn_dev: + isert_device_put(device); out: kfree(isert_conn); rdma_reject(cma_id, NULL, 0, IB_CM_REJ_CONSUMER_DEFINED);
The device is got by isert_device_get() with refcount is 1, and is assigned to isert_conn by isert_conn->device = device. When isert_create_qp() failed, device will be freed with isert_device_put(). Later, the device is used in isert_free_login_buf(isert_conn) by the isert_conn->device->ib_device statement. This patch free the device in the correct order. Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn> --- drivers/infiniband/ulp/isert/ib_isert.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)