UbiquitousOS
/
OpenCloudOS-Kernel
mirror of https://gitee.com/OpenCloudOS/OpenCloudOS-Kernel.git
11
0
Fork 0
Code Issues Projects Releases Wiki Activity

RDMA/core: Fix use after free and refcnt leak on ndev in_device in iwarp_query_port 

If an iWARP driver is probed and removed while there are no ips set for
the device, it will lead to a reference count leak on the inet device of
the netdevice.

In addition, the netdevice was accessed after already calling netdev_put,
which could lead to using the netdev after already freed.

Fixes: 4929116bdf ("RDMA/core: Add common iWARP query port")
Link: https://lore.kernel.org/r/20190925123332.10746-1-michal.kalderon@marvell.com
Signed-off-by: Ariel Elior <ariel.elior@marvell.com>
Signed-off-by: Michal Kalderon <michal.kalderon@marvell.com>
Reviewed-by: Shiraz Saleem <shiraz.saleem@intel.com>
Reviewed-by: Kamal Heib <kamalheib1@gmail.com>
Reviewed-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
This commit is contained in:
Michal Kalderon 2019-09-25 15:33:32 +03:00 committed by Jason Gunthorpe
parent df791c54d6
commit 390d3fdcae
1 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
drivers/infiniband/core/device.c
View File

@ -1987,8 +1987,6 @@ static int iw_query_port(struct ib_device *device,
if (!netdev) if (!netdev)
return -ENODEV; return -ENODEV;
dev_put(netdev);
port_attr->max_mtu = IB_MTU_4096; port_attr->max_mtu = IB_MTU_4096;
port_attr->active_mtu = ib_mtu_int_to_enum(netdev->mtu); port_attr->active_mtu = ib_mtu_int_to_enum(netdev->mtu);
@ -1996,19 +1994,22 @@ static int iw_query_port(struct ib_device *device,
port_attr->state = IB_PORT_DOWN; port_attr->state = IB_PORT_DOWN;
port_attr->phys_state = IB_PORT_PHYS_STATE_DISABLED; port_attr->phys_state = IB_PORT_PHYS_STATE_DISABLED;
} else { } else {
inetdev = in_dev_get(netdev); rcu_read_lock();
inetdev = __in_dev_get_rcu(netdev);
if (inetdev && inetdev->ifa_list) { if (inetdev && inetdev->ifa_list) {
port_attr->state = IB_PORT_ACTIVE; port_attr->state = IB_PORT_ACTIVE;
port_attr->phys_state = IB_PORT_PHYS_STATE_LINK_UP; port_attr->phys_state = IB_PORT_PHYS_STATE_LINK_UP;
in_dev_put(inetdev);
} else { } else {
port_attr->state = IB_PORT_INIT; port_attr->state = IB_PORT_INIT;
port_attr->phys_state = port_attr->phys_state =
IB_PORT_PHYS_STATE_PORT_CONFIGURATION_TRAINING; IB_PORT_PHYS_STATE_PORT_CONFIGURATION_TRAINING;
} }
rcu_read_unlock();
} }
dev_put(netdev);
err = device->ops.query_port(device, port_num, port_attr); err = device->ops.query_port(device, port_num, port_attr);
if (err) if (err)
return err; return err;