Unverified Commit 57d28ae7 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!10987 RDMA/iwcm: Fix a use-after-free related to destroying CM IDs 

Merge Pull Request from: @ci-robot 
 
PR sync from: Liu Jian <liujian56@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/5AMMMAEFHF4TXIXZB4LL3LSPMTJUDEVM/ 
 
https://gitee.com/src-openeuler/kernel/issues/IAKQB2 
 
Link:https://gitee.com/openeuler/kernel/pulls/10987

 

Reviewed-by: default avatarLiu YongQiang <liuyongqiang13@huawei.com>
Reviewed-by: default avatarYue Haibing <yuehaibing@huawei.com>
Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
parents 611f0fce a3a40bf0

drivers/infiniband/core/iwcm.c

+7 −4
Original line number Diff line number Diff line
@@ -367,8 +367,10 @@ EXPORT_SYMBOL(iw_cm_disconnect); 
 *

 * Clean up all resources associated with the connection and release

 * the initial reference taken by iw_create_cm_id.

 *

 * Returns true if and only if the last cm_id_priv reference has been dropped.

 */

static void destroy_cm_id(struct iw_cm_id *cm_id)

static bool destroy_cm_id(struct iw_cm_id *cm_id)

{

	struct iwcm_id_private *cm_id_priv;

	unsigned long flags;
@@ -436,7 +438,7 @@ static void destroy_cm_id(struct iw_cm_id *cm_id) 
		iwpm_remove_mapping(&cm_id->local_addr, RDMA_NL_IWCM);

	}



	(void)iwcm_deref_id(cm_id_priv);

	return iwcm_deref_id(cm_id_priv);

}



/*
@@ -447,7 +449,8 @@ static void destroy_cm_id(struct iw_cm_id *cm_id) 
 */

void iw_destroy_cm_id(struct iw_cm_id *cm_id)

{

	destroy_cm_id(cm_id);

	if (!destroy_cm_id(cm_id))

		flush_workqueue(iwcm_wq);

}

EXPORT_SYMBOL(iw_destroy_cm_id);
@@ -1020,7 +1023,7 @@ static void cm_work_handler(struct work_struct *_work) 
		if (!test_bit(IWCM_F_DROP_EVENTS, &cm_id_priv->flags)) {

			ret = process_event(cm_id_priv, &levent);

			if (ret)

				destroy_cm_id(&cm_id_priv->id);

				WARN_ON_ONCE(destroy_cm_id(&cm_id_priv->id));

		} else

			pr_debug("dropping event %d\n", levent.event);

		if (iwcm_deref_id(cm_id_priv))