* [PATCH rdma-next] RDMA/core: Fix use after free and refcnt leak on ndev in_device in iwarp_query_port
@ 2019-09-25 12:33 Michal Kalderon
2019-09-25 16:46 ` Saleem, Shiraz
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: Michal Kalderon @ 2019-09-25 12:33 UTC (permalink / raw)
To: dledford, jgg, kamalheib1, michal.kalderon, aelior; +Cc: leon, linux-rdma
If an iWARP driver is probed and removed while there are no ips
set for the device, it will lead to a reference count leak on
the inet device of the netdevice.
In addition, the netdevice was accessed after already calling
netdev_put, which could lead to using the netdev after already
freed.
Fixes: 4929116bdf72 ("RDMA/core: Add common iWARP query port")
Signed-off-by: Ariel Elior <ariel.elior@marvell.com>
Signed-off-by: Michal Kalderon <michal.kalderon@marvell.com>
---
drivers/infiniband/core/device.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
index 99c4a55545cf..2dd2cfe9b561 100644
--- a/drivers/infiniband/core/device.c
+++ b/drivers/infiniband/core/device.c
@@ -1987,8 +1987,6 @@ static int iw_query_port(struct ib_device *device,
if (!netdev)
return -ENODEV;
- dev_put(netdev);
-
port_attr->max_mtu = IB_MTU_4096;
port_attr->active_mtu = ib_mtu_int_to_enum(netdev->mtu);
@@ -1996,19 +1994,22 @@ static int iw_query_port(struct ib_device *device,
port_attr->state = IB_PORT_DOWN;
port_attr->phys_state = IB_PORT_PHYS_STATE_DISABLED;
} else {
- inetdev = in_dev_get(netdev);
+ rcu_read_lock();
+ inetdev = __in_dev_get_rcu(netdev);
if (inetdev && inetdev->ifa_list) {
port_attr->state = IB_PORT_ACTIVE;
port_attr->phys_state = IB_PORT_PHYS_STATE_LINK_UP;
- in_dev_put(inetdev);
} else {
port_attr->state = IB_PORT_INIT;
port_attr->phys_state =
IB_PORT_PHYS_STATE_PORT_CONFIGURATION_TRAINING;
}
+
+ rcu_read_unlock();
}
+ dev_put(netdev);
err = device->ops.query_port(device, port_num, port_attr);
if (err)
return err;
--
2.20.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* RE: [PATCH rdma-next] RDMA/core: Fix use after free and refcnt leak on ndev in_device in iwarp_query_port
2019-09-25 12:33 [PATCH rdma-next] RDMA/core: Fix use after free and refcnt leak on ndev in_device in iwarp_query_port Michal Kalderon
@ 2019-09-25 16:46 ` Saleem, Shiraz
2019-09-25 18:45 ` Kamal Heib
2019-10-01 14:34 ` Jason Gunthorpe
2 siblings, 0 replies; 4+ messages in thread
From: Saleem, Shiraz @ 2019-09-25 16:46 UTC (permalink / raw)
To: Michal Kalderon, dledford, jgg, kamalheib1, aelior; +Cc: leon, linux-rdma
> Subject: [PATCH rdma-next] RDMA/core: Fix use after free and refcnt leak on ndev
> in_device in iwarp_query_port
>
> If an iWARP driver is probed and removed while there are no ips set for the device,
> it will lead to a reference count leak on the inet device of the netdevice.
>
> In addition, the netdevice was accessed after already calling netdev_put, which
> could lead to using the netdev after already freed.
>
> Fixes: 4929116bdf72 ("RDMA/core: Add common iWARP query port")
> Signed-off-by: Ariel Elior <ariel.elior@marvell.com>
> Signed-off-by: Michal Kalderon <michal.kalderon@marvell.com>
> ---
Looks ok. Thanks!
Reviewed-by: Shiraz Saleem <shiraz.saleem@intel.com>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH rdma-next] RDMA/core: Fix use after free and refcnt leak on ndev in_device in iwarp_query_port
2019-09-25 12:33 [PATCH rdma-next] RDMA/core: Fix use after free and refcnt leak on ndev in_device in iwarp_query_port Michal Kalderon
2019-09-25 16:46 ` Saleem, Shiraz
@ 2019-09-25 18:45 ` Kamal Heib
2019-10-01 14:34 ` Jason Gunthorpe
2 siblings, 0 replies; 4+ messages in thread
From: Kamal Heib @ 2019-09-25 18:45 UTC (permalink / raw)
To: Michal Kalderon; +Cc: dledford, jgg, aelior, leon, linux-rdma
On Wed, Sep 25, 2019 at 03:33:32PM +0300, Michal Kalderon wrote:
> If an iWARP driver is probed and removed while there are no ips
> set for the device, it will lead to a reference count leak on
> the inet device of the netdevice.
>
> In addition, the netdevice was accessed after already calling
> netdev_put, which could lead to using the netdev after already
> freed.
>
> Fixes: 4929116bdf72 ("RDMA/core: Add common iWARP query port")
> Signed-off-by: Ariel Elior <ariel.elior@marvell.com>
> Signed-off-by: Michal Kalderon <michal.kalderon@marvell.com>
> ---
Thanks!
Reviewed-by: Kamal Heib <kamalheib1@gmail.com>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH rdma-next] RDMA/core: Fix use after free and refcnt leak on ndev in_device in iwarp_query_port
2019-09-25 12:33 [PATCH rdma-next] RDMA/core: Fix use after free and refcnt leak on ndev in_device in iwarp_query_port Michal Kalderon
2019-09-25 16:46 ` Saleem, Shiraz
2019-09-25 18:45 ` Kamal Heib
@ 2019-10-01 14:34 ` Jason Gunthorpe
2 siblings, 0 replies; 4+ messages in thread
From: Jason Gunthorpe @ 2019-10-01 14:34 UTC (permalink / raw)
To: Michal Kalderon; +Cc: dledford, kamalheib1, aelior, leon, linux-rdma
On Wed, Sep 25, 2019 at 03:33:32PM +0300, Michal Kalderon wrote:
> If an iWARP driver is probed and removed while there are no ips
> set for the device, it will lead to a reference count leak on
> the inet device of the netdevice.
>
> In addition, the netdevice was accessed after already calling
> netdev_put, which could lead to using the netdev after already
> freed.
>
> Fixes: 4929116bdf72 ("RDMA/core: Add common iWARP query port")
> Signed-off-by: Ariel Elior <ariel.elior@marvell.com>
> Signed-off-by: Michal Kalderon <michal.kalderon@marvell.com>
> Reviewed-by: Shiraz Saleem <shiraz.saleem@intel.com>
> Reviewed-by: Kamal Heib <kamalheib1@gmail.com>
> ---
> drivers/infiniband/core/device.c | 9 +++++----
> 1 file changed, 5 insertions(+), 4 deletions(-)
Applied to for-rc, thanks
Jason
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2019-10-01 14:34 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-09-25 12:33 [PATCH rdma-next] RDMA/core: Fix use after free and refcnt leak on ndev in_device in iwarp_query_port Michal Kalderon
2019-09-25 16:46 ` Saleem, Shiraz
2019-09-25 18:45 ` Kamal Heib
2019-10-01 14:34 ` Jason Gunthorpe
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).