Re: [PATCH 3/3] IB/srpt: Fix a use-after-free

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Tue, 2018-07-10 at 12:38 -0600, Jason Gunthorpe wrote:
> On Tue, Jul 10, 2018 at 10:32:00AM -0700, Bart Van Assche wrote:
> > diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c
> > index 325bae29e90d..705f6a992d82 100644
> > +++ b/drivers/infiniband/ulp/srpt/ib_srpt.c
> > @@ -2152,6 +2152,7 @@ static int srpt_cm_req_recv(struct srpt_device *const sdev,
> >  	}
> > 
> >  	kref_init(&ch->kref);
> > +	kref_get(&ch->kref);
> 
> Oh that is ugly, can you put the 'get' closer to the the place that
> stores the ch pointer this kref is protecting? Perhaps it is one of
> the list_add's in this function?
> 
> Guessing the kref created kref_init should probably belong to target_core's
> 'se_sess->fabric_sess_ptr' ..

Hello Jason,

Can you clarify your second paragraph? The ib_srpt driver has been implemented
such that sess->fabric_sess_ptr == ch as long as a session exists.

An ib_srpt RDMA channel object (ch in the above code) must stay around as long
as the associated target core session (se_sess) exists and also as long as the
target core has not yet called srpt_close_session(). Hence the initialization of
ch->kref to 2 just before an RDMA channel is registered with the target core.
Hence also the kref_put() calls in srpt_close_session() and
srpt_release_channel_work().

Bart.








[Index of Archives]     [Linux Kernel]     [Kernel Development Newbies]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite Hiking]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux