[PATCH v2 0/3] Fix a use-after-free in the SRP target driver

From: Bart Van Assche <bvanassche@acm.org>
To: Jason Gunthorpe <jgg@ziepe.ca>
Cc: Leon Romanovsky <leonro@mellanox.com>,
	linux-rdma@vger.kernel.org, Li Zhijian <lizhijian@fujitsu.com>,
	Hillf Danton <hdanton@sina.com>,
	Mike Christie <michael.christie@oracle.com>,
	Bart Van Assche <bvanassche@acm.org>
Subject: [PATCH v2 0/3] Fix a use-after-free in the SRP target driver
Date: Wed, 27 Jul 2022 12:34:12 -0700	[thread overview]
Message-ID: <20220727193415.1583860-1-bvanassche@acm.org> (raw)

Hi Jason,

A known issue in the SRP target driver is that a use-after-free is triggered
if an RDMA port is removed while a LIO target port is still associated with
that RDMA port. This patch series fixes that use-after-free.

Thanks,

Bart.

See also:
* Commit 9b64f7d0bb0a ("RDMA/srpt: Postpone HCA removal until after configfs directory removal").
* https://lore.kernel.org/all/17649b9c-7e42-1625-8bc9-8ad333ab771c@fujitsu.com/

Changes compared to v1:
- Left out three BUG_ON() statements.
- Added three WARN_ON_ONCE() statements.
- Removed an unnecessary if (!sport_id) statement block.

Bart Van Assche (3):
  RDMA/srpt: Duplicate port name members
  RDMA/srpt: Introduce a reference count in struct srpt_device
  RDMA/srpt: Fix a use-after-free

 drivers/infiniband/ulp/srpt/ib_srpt.c | 148 ++++++++++++++++++--------
 drivers/infiniband/ulp/srpt/ib_srpt.h |  18 ++--
 2 files changed, 118 insertions(+), 48 deletions(-)