> -----原始邮件-----
> 发件人: "Leon Romanovsky" <leon@xxxxxxxxxx>
> 发送时间: 2021-03-22 23:31:08 (星期一)
> 收件人: lyl2019@xxxxxxxxxxxxxxxx
> 抄送: sagi@xxxxxxxxxxx, dledford@xxxxxxxxxx, jgg@xxxxxxxx, linux-rdma@xxxxxxxxxxxxxxx, target-devel@xxxxxxxxxxxxxxx, linux-kernel@xxxxxxxxxxxxxxx
> 主题: Re: Re: [PATCH] infiniband: Fix a use after free in isert_connect_request
>
> On Mon, Mar 22, 2021 at 10:51:35PM +0800, lyl2019@xxxxxxxxxxxxxxxx wrote:
> >
> >
> >
> > > -----原始邮件-----
> > > 发件人: "Leon Romanovsky" <leon@xxxxxxxxxx>
> > > 发送时间: 2021-03-22 22:27:17 (星期一)
> > > 收件人: "Lv Yunlong" <lyl2019@xxxxxxxxxxxxxxxx>
> > > 抄送: sagi@xxxxxxxxxxx, dledford@xxxxxxxxxx, jgg@xxxxxxxx, linux-rdma@xxxxxxxxxxxxxxx, target-devel@xxxxxxxxxxxxxxx, linux-kernel@xxxxxxxxxxxxxxx
> > > 主题: Re: [PATCH] infiniband: Fix a use after free in isert_connect_request
> > >
> > > On Mon, Mar 22, 2021 at 06:53:55AM -0700, Lv Yunlong wrote:
> > > > The device is got by isert_device_get() with refcount is 1,
> > > > and is assigned to isert_conn by isert_conn->device = device.
> > > > When isert_create_qp() failed, device will be freed with
> > > > isert_device_put().
> > > >
> > > > Later, the device is used in isert_free_login_buf(isert_conn)
> > > > by the isert_conn->device->ib_device statement. My patch
> > > > exchanges the callees order to free the device late.
> > > >
> > > > Signed-off-by: Lv Yunlong <lyl2019@xxxxxxxxxxxxxxxx>
> > > > ---
> > > > drivers/infiniband/ulp/isert/ib_isert.c | 4 ++--
> > > > 1 file changed, 2 insertions(+), 2 deletions(-)
> > >
> > > The fix needs to be change of isert_free_login_buf() from
> > > isert_free_login_buf(isert_conn) to be isert_free_login_buf(isert_conn, cma_id->device)
> > >
> > > Thanks
> > >
> > > >
> > > > diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
> > > > index 7305ed8976c2..d8a533e346b0 100644
> > > > --- a/drivers/infiniband/ulp/isert/ib_isert.c
> > > > +++ b/drivers/infiniband/ulp/isert/ib_isert.c
> > > > @@ -473,10 +473,10 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
> > > >
> > > > out_destroy_qp:
> > > > isert_destroy_qp(isert_conn);
> > > > -out_conn_dev:
> > > > - isert_device_put(device);
> > > > out_rsp_dma_map:
> > > > isert_free_login_buf(isert_conn);
> > > > +out_conn_dev:
> > > > + isert_device_put(device);
> > > > out:
> > > > kfree(isert_conn);
> > > > rdma_reject(cma_id, NULL, 0, IB_CM_REJ_CONSUMER_DEFINED);
> > > > --
> > > > 2.25.1
> > > >
> > > >
> >
> > I see that function isert_free_login_buf(struct isert_conn *isert_conn) has only
> > a parameter, do you mean i need change the implementation of isert_free_login_buf?
> >
> > I'm sorry to say that i am unfamilar with this module and afraid of making more mistakes,
> > because this function is being called elsewhere as well.
> > Could you help me to fix this issue? Or just fix it and tell me your commit number?
>
> After checking how isert_connect_release() is implemented, it looks like
> this will fix:
>
> diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
> index 7305ed8976c2..18266f07c58d 100644
> --- a/drivers/infiniband/ulp/isert/ib_isert.c
> +++ b/drivers/infiniband/ulp/isert/ib_isert.c
> @@ -438,23 +438,23 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
> isert_init_conn(isert_conn);
> isert_conn->cm_id = cma_id;
>
> - ret = isert_alloc_login_buf(isert_conn, cma_id->device);
> - if (ret)
> - goto out;
> -
> device = isert_device_get(cma_id);
> if (IS_ERR(device)) {
> ret = PTR_ERR(device);
> - goto out_rsp_dma_map;
> + goto out;
> }
> isert_conn->device = device;
>
> + ret = isert_alloc_login_buf(isert_conn, cma_id->device);
> + if (ret)
> + goto out_conn_dev;
> +
> isert_set_nego_params(isert_conn, &event->param.conn);
>
> isert_conn->qp = isert_create_qp(isert_conn, cma_id);
> if (IS_ERR(isert_conn->qp)) {
> ret = PTR_ERR(isert_conn->qp);
> - goto out_conn_dev;
> + goto out_rsp_dma_map;
> }
>
> ret = isert_login_post_recv(isert_conn);
> @@ -473,10 +473,10 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
>
> out_destroy_qp:
> isert_destroy_qp(isert_conn);
> -out_conn_dev:
> - isert_device_put(device);
> out_rsp_dma_map:
> isert_free_login_buf(isert_conn);
> +out_conn_dev:
> + isert_device_put(device);
> out:
> kfree(isert_conn);
> rdma_reject(cma_id, NULL, 0, IB_CM_REJ_CONSUMER_DEFINED);
Ok, i think this fixes this issue.
I will commit a PATCH v2 later. Thank you very much.
