All of lore.kernel.org
 help / color / mirror / Atom feed
From: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
To: faisal.latif@intel.com, shiraz.saleem@intel.com,
	dledford@redhat.com, jgg@ziepe.ca
Cc: linux-rdma@vger.kernel.org, linux-kernel@vger.kernel.org,
	Lv Yunlong <lyl2019@mail.ustc.edu.cn>
Subject: [PATCH] infiniband/i40iw: Fix a use after free in i40iw_cm_event_handler
Date: Wed, 10 Mar 2021 19:14:14 -0800	[thread overview]
Message-ID: <20210311031414.5011-1-lyl2019@mail.ustc.edu.cn> (raw)

In the case of I40IW_CM_EVENT_ABORTED, i40iw_event_connect_error()
could be called to free the event->cm_node. However, event->cm_node
will be used after and cause use after free. It needs to add flags
to inform that event->cm_node has been freed.

Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
---
 drivers/infiniband/hw/i40iw/i40iw_cm.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/infiniband/hw/i40iw/i40iw_cm.c b/drivers/infiniband/hw/i40iw/i40iw_cm.c
index ac65c8237b2e..447b43c2d21f 100644
--- a/drivers/infiniband/hw/i40iw/i40iw_cm.c
+++ b/drivers/infiniband/hw/i40iw/i40iw_cm.c
@@ -4175,6 +4175,7 @@ static void i40iw_cm_event_handler(struct work_struct *work)
 						    struct i40iw_cm_event,
 						    event_work);
 	struct i40iw_cm_node *cm_node;
+	int flags = 0;
 
 	if (!event || !event->cm_node || !event->cm_node->cm_core)
 		return;
@@ -4211,6 +4212,7 @@ static void i40iw_cm_event_handler(struct work_struct *work)
 		    (event->cm_node->state == I40IW_CM_STATE_OFFLOADED))
 			break;
 		i40iw_event_connect_error(event);
+		flags = 1;
 		break;
 	default:
 		i40iw_pr_err("event type = %d\n", event->type);
@@ -4218,7 +4220,8 @@ static void i40iw_cm_event_handler(struct work_struct *work)
 	}
 
 	event->cm_info.cm_id->rem_ref(event->cm_info.cm_id);
-	i40iw_rem_ref_cm_node(event->cm_node);
+	if (!flags)
+		i40iw_rem_ref_cm_node(event->cm_node);
 	kfree(event);
 }
 
-- 
2.25.1



             reply	other threads:[~2021-03-11  3:15 UTC|newest]

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-03-11  3:14 Lv Yunlong [this message]
2021-03-11 18:21 ` [PATCH] infiniband/i40iw: Fix a use after free in i40iw_cm_event_handler Jason Gunthorpe
2021-03-12  1:13   ` Saleem, Shiraz
2021-03-12  1:57     ` lyl2019
2021-03-13  1:11       ` Saleem, Shiraz

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210311031414.5011-1-lyl2019@mail.ustc.edu.cn \
    --to=lyl2019@mail.ustc.edu.cn \
    --cc=dledford@redhat.com \
    --cc=faisal.latif@intel.com \
    --cc=jgg@ziepe.ca \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-rdma@vger.kernel.org \
    --cc=shiraz.saleem@intel.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.