Commit adb76a52 authored by Lv Yunlong's avatar Lv Yunlong Committed by Jason Gunthorpe
Browse files

IB/isert: Fix a use after free in isert_connect_request 

The device is got by isert_device_get() with refcount is 1, and is
assigned to isert_conn by
  isert_conn->device = device.

When isert_create_qp() failed, device will be freed with
isert_device_put().

Later, the device is used in isert_free_login_buf(isert_conn) by the
isert_conn->device->ib_device statement.

Free the device in the correct order.

Fixes: ae9ea9ed ("iser-target: Split some logic in isert_connect_request to routines")
Link: https://lore.kernel.org/r/20210322161325.7491-1-lyl2019@mail.ustc.edu.cn


Signed-off-by: default avatarLv Yunlong <lyl2019@mail.ustc.edu.cn>
Acked-by: default avatarSagi Grimberg <sagi@grimberg.me>
Reviewed-by: default avatarLeon Romanovsky <leonro@nvidia.com>
Reviewed-by: default avatarMax Gurtovoy <mgurtovoy@nvidia.com>
Signed-off-by: default avatarJason Gunthorpe <jgg@nvidia.com>
parent aa43665a

drivers/infiniband/ulp/isert/ib_isert.c

+8 −8
Original line number Diff line number Diff line
@@ -438,23 +438,23 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event) 
	isert_init_conn(isert_conn);

	isert_conn->cm_id = cma_id;



	ret = isert_alloc_login_buf(isert_conn, cma_id->device);

	if (ret)

		goto out;



	device = isert_device_get(cma_id);

	if (IS_ERR(device)) {

		ret = PTR_ERR(device);

		goto out_rsp_dma_map;

		goto out;

	}

	isert_conn->device = device;



	ret = isert_alloc_login_buf(isert_conn, cma_id->device);

	if (ret)

		goto out_conn_dev;



	isert_set_nego_params(isert_conn, &event->param.conn);



	isert_conn->qp = isert_create_qp(isert_conn, cma_id);

	if (IS_ERR(isert_conn->qp)) {

		ret = PTR_ERR(isert_conn->qp);

		goto out_conn_dev;

		goto out_rsp_dma_map;

	}



	ret = isert_login_post_recv(isert_conn);
@@ -473,10 +473,10 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event) 


out_destroy_qp:

	isert_destroy_qp(isert_conn);

out_conn_dev:

	isert_device_put(device);

out_rsp_dma_map:

	isert_free_login_buf(isert_conn);

out_conn_dev:

	isert_device_put(device);

out:

	kfree(isert_conn);

	rdma_reject(cma_id, NULL, 0, IB_CM_REJ_CONSUMER_DEFINED);