MIRRORS/linux-imx
1
0
Fork 0
mirror of https://github.com/nxp-imx/linux-imx.git synced 2025-09-02 18:06:13 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity
lf-6.6.y
linux-imx/drivers/infiniband/core
History
Bart Van Assche ff5bbbdee0 RDMA/iwcm: Fix a use-after-free related to destroying CM IDs 
commit aee2424246 upstream.

iw_conn_req_handler() associates a new struct rdma_id_private (conn_id) with
an existing struct iw_cm_id (cm_id) as follows:

        conn_id->cm_id.iw = cm_id;
        cm_id->context = conn_id;
        cm_id->cm_handler = cma_iw_handler;

rdma_destroy_id() frees both the cm_id and the struct rdma_id_private. Make
sure that cm_work_handler() does not trigger a use-after-free by only
freeing of the struct rdma_id_private after all pending work has finished.

Cc: stable@vger.kernel.org
Fixes: 59c68ac31e ("iw_cm: free cm_id resources on the last deref")
Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev>
Tested-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com>
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Link: https://lore.kernel.org/r/20240605145117.397751-6-bvanassche@acm.org
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-08-03 08:54:30 +02:00
..
addr.c RDMA/core: Delete useless module.h include 2022-01-28 13:03:12 -04:00
agent.c RDMA: Mark if destroy address handle is in a sleepable context 2018-12-19 16:28:03 -07:00
agent.h IB/mad: Add final OPA MAD processing 2015-06-12 14:49:18 -04:00
cache.c RDMA/cache: Release GID table even if leak is detected 2024-08-03 08:53:57 +02:00
cgroup.c
cm_msgs.h RDMA/core: Add necessary spaces 2021-04-12 14:52:22 -03:00
cm_trace.c RDMA/cm: Replace pr_debug() call sites with tracepoints 2020-08-24 19:41:41 -03:00
cm_trace.h trace: Relocate event helper files 2022-12-10 11:01:12 -05:00
cm.c RDMA/cm: Print the old state when cm_destroy_id gets timeout 2024-04-27 17:11:34 +02:00
cma_configfs.c RDMA/cma: Fix truncation compilation warning in make_cma_ports 2023-09-18 11:52:10 +03:00
cma_priv.h RDMA/core: Add an rb_tree that stores cm_ids sorted by ifindex and remote IP 2022-06-16 09:54:35 +03:00
cma_trace.c
cma_trace.h trace: Relocate event helper files 2022-12-10 11:01:12 -05:00
cma.c RDMA/cma: Fix kmemleak in rdma_core observed during blktests nvme/rdma use siw 2024-06-12 11:12:11 +02:00
core_priv.h RDMA/core: Create clean QP creations interface for uverbs 2021-08-03 15:26:19 -03:00
counters.c RDMA/counter: Add optional counter support 2021-10-12 12:48:05 -03:00
cq.c RDMA/core: Delete useless module.h include 2022-01-28 13:03:12 -04:00
device.c RDMA: Fix netdev tracker in ib_device_set_netdev 2024-08-03 08:54:04 +02:00
ib_core_uverbs.c RDMA/core: Ensure that rdma_user_mmap_entry_remove() is a fence 2020-01-25 14:48:33 -04:00
iwcm.c RDMA/iwcm: Fix a use-after-free related to destroying CM IDs 2024-08-03 08:54:30 +02:00
iwcm.h RDMA/core: Use refcount_t instead of atomic_t on refcount of iwcm_id_private 2021-06-08 14:35:44 -03:00
iwpm_msg.c RDMA/iwpm: Rely on the rdma_nl_[un]register() to ensure that requests are valid 2021-07-30 10:01:41 -03:00
iwpm_util.c RDMA: Remove unnecessary NULL values 2023-08-07 16:56:57 +03:00
iwpm_util.h RDMA/core: Delete useless module.h include 2022-01-28 13:03:12 -04:00
lag.c RDMA/core: Remove NULL check before dev_{put, hold} 2024-08-03 08:54:03 +02:00
mad_priv.h RDMA/core: Remove refcount from struct ib_mad_snoop_private 2021-06-08 14:43:28 -03:00
mad_rmpp.c RDMA/core: Remove redundant spaces 2021-04-12 14:56:48 -03:00
mad_rmpp.h
mad.c IB/mad: Don't call to function that might sleep while in atomic context 2022-11-10 10:57:15 +02:00
Makefile RDMA/umem: Support importing dma-buf as user memory region 2021-01-20 16:07:52 -04:00
mr_pool.c
multicast.c RDMA/core: Use refcount_t instead of atomic_t on refcount of mcast_port 2021-06-08 14:45:07 -03:00
netlink.c RDMA: Remove unnecessary ternary operators 2023-07-31 15:16:12 +03:00
nldev.c RDMA/core: Require admin capabilities to set system parameters 2023-10-05 20:01:47 +03:00
opa_smi.h RDMA: Support more than 255 rdma ports 2021-03-26 09:31:21 -03:00
packer.c
rdma_core.c RDMA: Correct duplicated words in comments 2022-06-24 16:52:28 -03:00
rdma_core.h
restrack.c RDMA/restrack: Fix potential invalid address access 2024-07-05 09:33:51 +02:00
restrack.h
roce_gid_mgmt.c RDMA/core: Remove NULL check before dev_{put, hold} 2024-08-03 08:54:03 +02:00
rw.c RDMA/rw: drop pci_p2pdma_[un]map_sg() 2022-07-26 07:28:07 -04:00
sa_query.c RDMA/core: Use size_{add,sub,mul}() in calls to struct_size() 2023-11-20 11:59:18 +01:00
sa.h RDMA: Support more than 255 rdma ports 2021-03-26 09:31:21 -03:00
security.c IB/core: Removed port validity check from ib_get_cached_subnet_prefix 2021-06-21 20:49:32 -03:00
smi.c RDMA: Support more than 255 rdma ports 2021-03-26 09:31:21 -03:00
smi.h RDMA: Support more than 255 rdma ports 2021-03-26 09:31:21 -03:00
sysfs.c RDMA/core: Use size_{add,sub,mul}() in calls to struct_size() 2023-11-20 11:59:18 +01:00
trace.c
ucma.c RDMA/core: Rename rdma_route.num_paths field to num_pri_alt_paths 2022-09-22 12:35:13 +03:00
ud_header.c RDMA/core: Fix incorrect print format specifier 2021-06-21 15:38:30 -03:00
umem_dmabuf.c RDMA/umem: Use dma-buf locked API to solve deadlock 2023-01-31 10:24:49 -04:00
umem_odp.c Linux 6.0 2022-10-06 19:48:45 -03:00
umem.c RDMA/core: Fix umem iterator when PAGE_SIZE is greater then HCA pgsz 2023-12-13 18:45:16 +01:00
user_mad.c IB/core: Implement a limit on UMAD receive List 2024-07-11 12:49:03 +02:00
uverbs_cmd.c RDMA/uverbs: Restrict usage of privileged QKEYs 2023-06-11 11:26:06 +03:00
uverbs_ioctl.c RDMA/core: Add UVERBS_ATTR_RAW_FD 2022-09-27 10:15:24 -03:00
uverbs_main.c RDMA/uverbs: Fix typo of sizeof argument 2023-09-11 15:01:09 +03:00
uverbs_marshall.c RDMA/core: Don't infoleak GRH fields 2022-01-05 16:30:19 -04:00
uverbs_std_types_async_fd.c RDMA/core: Make FD destroy callback void 2020-11-12 12:32:17 -04:00
uverbs_std_types_counters.c IB/uverbs: Fix an potential error pointer dereference 2023-08-07 16:49:59 +03:00
uverbs_std_types_cq.c
uverbs_std_types_device.c RDMA/uverbs: Fix a NULL vs IS_ERR() bug 2021-05-19 15:32:07 -03:00
uverbs_std_types_dm.c
uverbs_std_types_flow_action.c RDMA/core: Delete IPsec flow action logic from the core 2022-04-09 08:25:06 +03:00
uverbs_std_types_mr.c RDMA/uverbs: Track dmabuf memory regions 2021-08-19 09:59:53 -03:00
uverbs_std_types_qp.c IB/uverbs: fix the typo of optional 2022-10-19 09:46:45 +03:00
uverbs_std_types_srq.c
uverbs_std_types_wq.c
uverbs_std_types.c RDMA/core: Make FD destroy callback void 2020-11-12 12:32:17 -04:00
uverbs_uapi.c RDMA/uverbs: Check for null return of kmalloc_array 2022-01-05 14:16:53 -04:00
uverbs.h RDMA/core: Use refcount_t instead of atomic_t on refcount of ib_uverbs_device 2021-06-08 15:04:36 -03:00
verbs.c RDMA/core: Fix uninit-value access in ib_get_eth_speed() 2023-12-13 18:45:11 +01:00