On Tue, 20 Sep 2022 10:25:03 +0200, Bernard Metzler wrote:
> Delay QP destroy completion until all siw references to QP are
> dropped. The calling RDMA core will free QP structure after
> successful return from siw_qp_destroy() call, so siw must not
> hold any remaining reference to the QP upon return.
> A use-after-free was encountered in xfstest generic/460, while
> testing NFSoRDMA. Here, after a TCP connection drop by peer,
> the triggered siw_cm_work_handler got delayed until after
> QP destroy call, referencing a QP which has already freed.
>
> [...]
Applied, thanks!
[1/1] RDMA/siw: Fix QP destroy to wait for all references dropped.
https://git.kernel.org/rdma/rdma/c/a3c278807a459e
Best regards,
--
Leon Romanovsky <leon@xxxxxxxxxx>
