Re: Re: Re: [PATCH] infiniband: Fix a use after free in isert_connect_request

[lyl2019@mail.ustc.edu.cn]

> -----原始邮件-----
> 发件人: "Leon Romanovsky" <leon@kernel.org>
> 发送时间: 2021-03-22 23:31:08 (星期一)
> 收件人: lyl2019@mail.ustc.edu.cn
> 抄送: sagi@grimberg.me, dledford@redhat.com, jgg@ziepe.ca, linux-rdma@vger.kernel.org, target-devel@vger.kernel.org, linux-kernel@vger.kernel.org
> 主题: Re: Re: [PATCH] infiniband: Fix a use after free in isert_connect_request
> 
> On Mon, Mar 22, 2021 at 10:51:35PM +0800, lyl2019@mail.ustc.edu.cn wrote:
> > 
> > 
> > 
> > > -----原始邮件-----
> > > 发件人: "Leon Romanovsky" <leon@kernel.org>
> > > 发送时间: 2021-03-22 22:27:17 (星期一)
> > > 收件人: "Lv Yunlong" <lyl2019@mail.ustc.edu.cn>
> > > 抄送: sagi@grimberg.me, dledford@redhat.com, jgg@ziepe.ca, linux-rdma@vger.kernel.org, target-devel@vger.kernel.org, linux-kernel@vger.kernel.org
> > > 主题: Re: [PATCH] infiniband: Fix a use after free in isert_connect_request
> > > 
> > > On Mon, Mar 22, 2021 at 06:53:55AM -0700, Lv Yunlong wrote:
> > > > The device is got by isert_device_get() with refcount is 1,
> > > > and is assigned to isert_conn by isert_conn->device = device.
> > > > When isert_create_qp() failed, device will be freed with
> > > > isert_device_put().
> > > > 
> > > > Later, the device is used in isert_free_login_buf(isert_conn)
> > > > by the isert_conn->device->ib_device statement. My patch
> > > > exchanges the callees order to free the device late.
> > > > 
> > > > Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
> > > > ---
> > > >  drivers/infiniband/ulp/isert/ib_isert.c | 4 ++--
> > > >  1 file changed, 2 insertions(+), 2 deletions(-)
> > > 
> > > The fix needs to be change of isert_free_login_buf() from
> > > isert_free_login_buf(isert_conn) to be isert_free_login_buf(isert_conn, cma_id->device)
> > > 
> > > Thanks
> > > 
> > > > 
> > > > diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
> > > > index 7305ed8976c2..d8a533e346b0 100644
> > > > --- a/drivers/infiniband/ulp/isert/ib_isert.c
> > > > +++ b/drivers/infiniband/ulp/isert/ib_isert.c
> > > > @@ -473,10 +473,10 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
> > > >  
> > > >  out_destroy_qp:
> > > >  	isert_destroy_qp(isert_conn);
> > > > -out_conn_dev:
> > > > -	isert_device_put(device);
> > > >  out_rsp_dma_map:
> > > >  	isert_free_login_buf(isert_conn);
> > > > +out_conn_dev:
> > > > +	isert_device_put(device);
> > > >  out:
> > > >  	kfree(isert_conn);
> > > >  	rdma_reject(cma_id, NULL, 0, IB_CM_REJ_CONSUMER_DEFINED);
> > > > -- 
> > > > 2.25.1
> > > > 
> > > > 
> > 
> > I see that function isert_free_login_buf(struct isert_conn *isert_conn) has only
> > a parameter,  do you mean i need change the implementation of isert_free_login_buf?
> > 
> > I'm sorry to say that i am unfamilar with this module and afraid of making more mistakes,
> > because this function is being called elsewhere as well.
> > Could you help me to fix this issue? Or just fix it and tell me your commit number?
> 
> After checking how isert_connect_release() is implemented, it looks like
> this will fix:
> 
> diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
> index 7305ed8976c2..18266f07c58d 100644
> --- a/drivers/infiniband/ulp/isert/ib_isert.c
> +++ b/drivers/infiniband/ulp/isert/ib_isert.c
> @@ -438,23 +438,23 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
>  	isert_init_conn(isert_conn);
>  	isert_conn->cm_id = cma_id;
>  
> -	ret = isert_alloc_login_buf(isert_conn, cma_id->device);
> -	if (ret)
> -		goto out;
> -
>  	device = isert_device_get(cma_id);
>  	if (IS_ERR(device)) {
>  		ret = PTR_ERR(device);
> -		goto out_rsp_dma_map;
> +		goto out;
>  	}
>  	isert_conn->device = device;
>  
> +	ret = isert_alloc_login_buf(isert_conn, cma_id->device);
> +	if (ret)
> +		goto out_conn_dev;
> +
>  	isert_set_nego_params(isert_conn, &event->param.conn);
>  
>  	isert_conn->qp = isert_create_qp(isert_conn, cma_id);
>  	if (IS_ERR(isert_conn->qp)) {
>  		ret = PTR_ERR(isert_conn->qp);
> -		goto out_conn_dev;
> +		goto out_rsp_dma_map;
>  	}
>  
>  	ret = isert_login_post_recv(isert_conn);
> @@ -473,10 +473,10 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
>  
>  out_destroy_qp:
>  	isert_destroy_qp(isert_conn);
> -out_conn_dev:
> -	isert_device_put(device);
>  out_rsp_dma_map:
>  	isert_free_login_buf(isert_conn);
> +out_conn_dev:
> +	isert_device_put(device);
>  out:
>  	kfree(isert_conn);
>  	rdma_reject(cma_id, NULL, 0, IB_CM_REJ_CONSUMER_DEFINED);

Ok, i think this fixes this issue. 

I will commit a PATCH v2 later. Thank you very much.