RDMA/siw: free siw_base_qp in kref release routine (e17fa5c9) · Commits · 戴 / test

As siw_free_qp() is the last routine to access 'siw_base_qp' structure, freeing this structure early in siw_destroy_qp() could cause touch-after-free issue. Hence, moved kfree(siw_base_qp) from siw_destroy_qp() to siw_free_qp(). Fixes: ("rdma/siw: application interface") Signed-off-by:

Krishnamraju Eraparaju <krishna2@chelsio.com> Link: https://lore.kernel.org/r/20191007104229.29412-1-krishna2@chelsio.com Signed-off-by:

Doug Ledford <dledford@redhat.com>

drivers/infiniband/sw/siw/siw_qp.c

+2 −0

Original line number	Diff line number	Diff line
		@@ -1312,6 +1312,7 @@ int siw_qp_add(struct siw_device sdev, struct siw_qp qp)
		void siw_free_qp(struct kref *ref)
		{
		struct siw_qp found, qp = container_of(ref, struct siw_qp, ref);
		struct siw_base_qp *siw_base_qp = to_siw_base_qp(qp->ib_qp);
		struct siw_device *sdev = qp->sdev;
		unsigned long flags;

		@@ -1334,4 +1335,5 @@ void siw_free_qp(struct kref *ref)
		atomic_dec(&sdev->num_qp);
		siw_dbg_qp(qp, "free QP\n");
		kfree_rcu(qp, rcu);
		kfree(siw_base_qp);
		}

drivers/infiniband/sw/siw/siw_verbs.c

+0 −2

Original line number	Diff line number	Diff line
		@@ -604,7 +604,6 @@ out:
		int siw_destroy_qp(struct ib_qp base_qp, struct ib_udata udata)
		{
		struct siw_qp *qp = to_siw_qp(base_qp);
		struct siw_base_qp *siw_base_qp = to_siw_base_qp(base_qp);
		struct siw_ucontext *uctx =
		rdma_udata_to_drv_context(udata, struct siw_ucontext,
		base_ucontext);
		@@ -641,7 +640,6 @@ int siw_destroy_qp(struct ib_qp base_qp, struct ib_udata udata)
		qp->scq = qp->rcq = NULL;

		siw_qp_put(qp);
		kfree(siw_base_qp);

		return 0;
		}

Admin message