In case siw module can't be inserted successfully, then remove the
module from kernel, which means both siw_cm_exit and the failure
path in siw_init_module call crypto_free_shash. We can see below
call trace appears.
[ 72.349344] ------------[ cut here ]------------
[ 72.349348] refcount_t: underflow; use-after-free.
[ 72.349386] WARNING: CPU: 1 PID: 1737 at lib/refcount.c:28 refcount_warn_saturate+0xfb/0x150
...
[ 72.349469] RIP: 0010:refcount_warn_saturate+0xfb/0x150
...
[ 72.349487] Call Trace:
[ 72.349488] <TASK>
[ 72.349490] ? show_regs+0x72/0x90
[ 72.349493] ? refcount_warn_saturate+0xfb/0x150
[ 72.349495] ? __warn+0x8d/0x1a0
[ 72.349498] ? refcount_warn_saturate+0xfb/0x150
[ 72.349500] ? report_bug+0x1f9/0x250
[ 72.349505] ? handle_bug+0x46/0x90
[ 72.349508] ? exc_invalid_op+0x19/0x80
[ 72.349511] ? asm_exc_invalid_op+0x1b/0x20
[ 72.349517] ? refcount_warn_saturate+0xfb/0x150
[ 72.349519] ? refcount_warn_saturate+0xfb/0x150
[ 72.349521] crypto_destroy_tfm+0x9b/0xe0
[ 72.349525] siw_exit_module+0xf6/0x590 [siw]
So we need to set siw_crypto_shash to null in the failure path of
siw_init_module.
Signed-off-by: Guoqing Jiang <guoqing.jiang@xxxxxxxxx>
---
drivers/infiniband/sw/siw/siw_main.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/infiniband/sw/siw/siw_main.c b/drivers/infiniband/sw/siw/siw_main.c
index 6709ed0de3a4..f8549d01887f 100644
--- a/drivers/infiniband/sw/siw/siw_main.c
+++ b/drivers/infiniband/sw/siw/siw_main.c
@@ -589,8 +589,10 @@ static __init int siw_init_module(void)
siw_tx_thread[nr_cpu] = NULL;
}
}
- if (siw_crypto_shash)
+ if (siw_crypto_shash) {
crypto_free_shash(siw_crypto_shash);
+ siw_crypto_shash = NULL;
+ }
pr_info("SoftIWARP attach failed. Error: %d\n", rv);
--
2.34.1
