Commit dd52f1cd authored by William Kucharski's avatar William Kucharski Committed by Zhengchao Shao
Browse files

RDMA/srpt: Do not register event handler until srpt device is fully setup 

mainline inclusion
from mainline-v6.9-rc1
commit c21a8870c98611e8f892511825c9607f1e2cd456
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9HK8Y
CVE: CVE-2024-26872

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c21a8870c98611e8f892511825c9607f1e2cd456



--------------------------------

Upon rare occasions, KASAN reports a use-after-free Write
in srpt_refresh_port().

This seems to be because an event handler is registered before the
srpt device is fully setup and a race condition upon error may leave a
partially setup event handler in place.

Instead, only register the event handler after srpt device initialization
is complete.

Fixes: a42d985b ("ib_srpt: Initial SRP Target merge for v3.3-rc1")
Signed-off-by: default avatarWilliam Kucharski <william.kucharski@oracle.com>
Link: https://lore.kernel.org/r/20240202091549.991784-2-william.kucharski@oracle.com


Reviewed-by: default avatarBart Van Assche <bvanassche@acm.org>
Signed-off-by: default avatarLeon Romanovsky <leon@kernel.org>

Conflicts:
	drivers/infiniband/ulp/srpt/ib_srpt.c

Signed-off-by: default avatarZhengchao Shao <shaozhengchao@huawei.com>
parent aaa8e73e

drivers/infiniband/ulp/srpt/ib_srpt.c

+2 −4
Original line number Diff line number Diff line
@@ -3058,7 +3058,6 @@ static void srpt_add_one(struct ib_device *device) 


	INIT_IB_EVENT_HANDLER(&sdev->event_handler, sdev->device,

			      srpt_event_handler);

	ib_register_event_handler(&sdev->event_handler);



	for (i = 1; i <= sdev->device->phys_port_cnt; i++) {

		sport = &sdev->port[i - 1];
@@ -3076,10 +3075,11 @@ static void srpt_add_one(struct ib_device *device) 
		if (srpt_refresh_port(sport)) {

			pr_err("MAD registration failed for %s-%d.\n",

			       sdev->device->name, i);

			goto err_event;

			goto err_cm;

		}

	}



	ib_register_event_handler(&sdev->event_handler);

	spin_lock(&srpt_dev_lock);

	list_add_tail(&sdev->list, &srpt_dev_list);

	spin_unlock(&srpt_dev_lock);
@@ -3089,8 +3089,6 @@ static void srpt_add_one(struct ib_device *device) 
	pr_debug("added %s.\n", device->name);

	return;



err_event:

	ib_unregister_event_handler(&sdev->event_handler);

err_cm:

	if (sdev->cm_id)

		ib_destroy_cm_id(sdev->cm_id);