| From 0c03d0b868a94519c6b43cbd43d8be4bab56f9f4 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Mon, 22 Mar 2021 09:13:25 -0700 |
| Subject: IB/isert: Fix a use after free in isert_connect_request |
| |
| From: Lv Yunlong <lyl2019@mail.ustc.edu.cn> |
| |
| [ Upstream commit adb76a520d068a54ee5ca82e756cf8e5a47363a4 ] |
| |
| The device is got by isert_device_get() with refcount is 1, and is |
| assigned to isert_conn by |
| isert_conn->device = device. |
| |
| When isert_create_qp() failed, device will be freed with |
| isert_device_put(). |
| |
| Later, the device is used in isert_free_login_buf(isert_conn) by the |
| isert_conn->device->ib_device statement. |
| |
| Free the device in the correct order. |
| |
| Fixes: ae9ea9ed38c9 ("iser-target: Split some logic in isert_connect_request to routines") |
| Link: https://lore.kernel.org/r/20210322161325.7491-1-lyl2019@mail.ustc.edu.cn |
| Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn> |
| Acked-by: Sagi Grimberg <sagi@grimberg.me> |
| Reviewed-by: Leon Romanovsky <leonro@nvidia.com> |
| Reviewed-by: Max Gurtovoy <mgurtovoy@nvidia.com> |
| Signed-off-by: Jason Gunthorpe <jgg@nvidia.com> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/infiniband/ulp/isert/ib_isert.c | 16 ++++++++-------- |
| 1 file changed, 8 insertions(+), 8 deletions(-) |
| |
| diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c |
| index 2ba27221ea85..11339cc72214 100644 |
| --- a/drivers/infiniband/ulp/isert/ib_isert.c |
| +++ b/drivers/infiniband/ulp/isert/ib_isert.c |
| @@ -438,23 +438,23 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event) |
| isert_init_conn(isert_conn); |
| isert_conn->cm_id = cma_id; |
| |
| - ret = isert_alloc_login_buf(isert_conn, cma_id->device); |
| - if (ret) |
| - goto out; |
| - |
| device = isert_device_get(cma_id); |
| if (IS_ERR(device)) { |
| ret = PTR_ERR(device); |
| - goto out_rsp_dma_map; |
| + goto out; |
| } |
| isert_conn->device = device; |
| |
| + ret = isert_alloc_login_buf(isert_conn, cma_id->device); |
| + if (ret) |
| + goto out_conn_dev; |
| + |
| isert_set_nego_params(isert_conn, &event->param.conn); |
| |
| isert_conn->qp = isert_create_qp(isert_conn, cma_id); |
| if (IS_ERR(isert_conn->qp)) { |
| ret = PTR_ERR(isert_conn->qp); |
| - goto out_conn_dev; |
| + goto out_rsp_dma_map; |
| } |
| |
| ret = isert_login_post_recv(isert_conn); |
| @@ -473,10 +473,10 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event) |
| |
| out_destroy_qp: |
| isert_destroy_qp(isert_conn); |
| -out_conn_dev: |
| - isert_device_put(device); |
| out_rsp_dma_map: |
| isert_free_login_buf(isert_conn); |
| +out_conn_dev: |
| + isert_device_put(device); |
| out: |
| kfree(isert_conn); |
| rdma_reject(cma_id, NULL, 0, IB_CM_REJ_CONSUMER_DEFINED); |
| -- |
| 2.30.2 |
| |