On Mon, Mar 22, 2021 at 10:51:35PM +0800, lyl2019@xxxxxxxxxxxxxxxx wrote:
>
>
>
> > -----原始邮件-----
> > 发件人: "Leon Romanovsky" <leon@xxxxxxxxxx>
> > 发送时间: 2021-03-22 22:27:17 (星期一)
> > 收件人: "Lv Yunlong" <lyl2019@xxxxxxxxxxxxxxxx>
> > 抄送: sagi@xxxxxxxxxxx, dledford@xxxxxxxxxx, jgg@xxxxxxxx, linux-rdma@xxxxxxxxxxxxxxx, target-devel@xxxxxxxxxxxxxxx, linux-kernel@xxxxxxxxxxxxxxx
> > 主题: Re: [PATCH] infiniband: Fix a use after free in isert_connect_request
> >
> > On Mon, Mar 22, 2021 at 06:53:55AM -0700, Lv Yunlong wrote:
> > > The device is got by isert_device_get() with refcount is 1,
> > > and is assigned to isert_conn by isert_conn->device = device.
> > > When isert_create_qp() failed, device will be freed with
> > > isert_device_put().
> > >
> > > Later, the device is used in isert_free_login_buf(isert_conn)
> > > by the isert_conn->device->ib_device statement. My patch
> > > exchanges the callees order to free the device late.
> > >
> > > Signed-off-by: Lv Yunlong <lyl2019@xxxxxxxxxxxxxxxx>
> > > ---
> > > drivers/infiniband/ulp/isert/ib_isert.c | 4 ++--
> > > 1 file changed, 2 insertions(+), 2 deletions(-)
> >
> > The fix needs to be change of isert_free_login_buf() from
> > isert_free_login_buf(isert_conn) to be isert_free_login_buf(isert_conn, cma_id->device)
> >
> > Thanks
> >
> > >
> > > diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
> > > index 7305ed8976c2..d8a533e346b0 100644
> > > --- a/drivers/infiniband/ulp/isert/ib_isert.c
> > > +++ b/drivers/infiniband/ulp/isert/ib_isert.c
> > > @@ -473,10 +473,10 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
> > >
> > > out_destroy_qp:
> > > isert_destroy_qp(isert_conn);
> > > -out_conn_dev:
> > > - isert_device_put(device);
> > > out_rsp_dma_map:
> > > isert_free_login_buf(isert_conn);
> > > +out_conn_dev:
> > > + isert_device_put(device);
> > > out:
> > > kfree(isert_conn);
> > > rdma_reject(cma_id, NULL, 0, IB_CM_REJ_CONSUMER_DEFINED);
> > > --
> > > 2.25.1
> > >
> > >
>
> I see that function isert_free_login_buf(struct isert_conn *isert_conn) has only
> a parameter, do you mean i need change the implementation of isert_free_login_buf?
>
> I'm sorry to say that i am unfamilar with this module and afraid of making more mistakes,
> because this function is being called elsewhere as well.
> Could you help me to fix this issue? Or just fix it and tell me your commit number?
After checking how isert_connect_release() is implemented, it looks like
this will fix:
diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
index 7305ed8976c2..18266f07c58d 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.c
+++ b/drivers/infiniband/ulp/isert/ib_isert.c
@@ -438,23 +438,23 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
isert_init_conn(isert_conn);
isert_conn->cm_id = cma_id;
- ret = isert_alloc_login_buf(isert_conn, cma_id->device);
- if (ret)
- goto out;
-
device = isert_device_get(cma_id);
if (IS_ERR(device)) {
ret = PTR_ERR(device);
- goto out_rsp_dma_map;
+ goto out;
}
isert_conn->device = device;
+ ret = isert_alloc_login_buf(isert_conn, cma_id->device);
+ if (ret)
+ goto out_conn_dev;
+
isert_set_nego_params(isert_conn, &event->param.conn);
isert_conn->qp = isert_create_qp(isert_conn, cma_id);
if (IS_ERR(isert_conn->qp)) {
ret = PTR_ERR(isert_conn->qp);
- goto out_conn_dev;
+ goto out_rsp_dma_map;
}
ret = isert_login_post_recv(isert_conn);
@@ -473,10 +473,10 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
out_destroy_qp:
isert_destroy_qp(isert_conn);
-out_conn_dev:
- isert_device_put(device);
out_rsp_dma_map:
isert_free_login_buf(isert_conn);
+out_conn_dev:
+ isert_device_put(device);
out:
kfree(isert_conn);
rdma_reject(cma_id, NULL, 0, IB_CM_REJ_CONSUMER_DEFINED);
