| Message ID | 20230727140349.25369-5-guoqing.jiang@linux.dev (mailing list archive) |
|---|---|
| State | Changes Requested |
| Headers | show |
| Series | [1/5] RDMA/siw: Set siw_cm_wq to NULL after it is destroyed | expand |
diff --git a/drivers/infiniband/sw/siw/siw_main.c b/drivers/infiniband/sw/siw/siw_main.c index 6709ed0de3a4..f8549d01887f 100644 --- a/drivers/infiniband/sw/siw/siw_main.c +++ b/drivers/infiniband/sw/siw/siw_main.c @@ -589,8 +589,10 @@ static __init int siw_init_module(void) siw_tx_thread[nr_cpu] = NULL; } } - if (siw_crypto_shash) + if (siw_crypto_shash) { crypto_free_shash(siw_crypto_shash); + siw_crypto_shash = NULL; + } pr_info("SoftIWARP attach failed. Error: %d\n", rv);
In case siw module can't be inserted successfully, then remove the module from kernel, which means both siw_cm_exit and the failure path in siw_init_module call crypto_free_shash. We can see below call trace appears. [ 72.349344] ------------[ cut here ]------------ [ 72.349348] refcount_t: underflow; use-after-free. [ 72.349386] WARNING: CPU: 1 PID: 1737 at lib/refcount.c:28 refcount_warn_saturate+0xfb/0x150 ... [ 72.349469] RIP: 0010:refcount_warn_saturate+0xfb/0x150 ... [ 72.349487] Call Trace: [ 72.349488] <TASK> [ 72.349490] ? show_regs+0x72/0x90 [ 72.349493] ? refcount_warn_saturate+0xfb/0x150 [ 72.349495] ? __warn+0x8d/0x1a0 [ 72.349498] ? refcount_warn_saturate+0xfb/0x150 [ 72.349500] ? report_bug+0x1f9/0x250 [ 72.349505] ? handle_bug+0x46/0x90 [ 72.349508] ? exc_invalid_op+0x19/0x80 [ 72.349511] ? asm_exc_invalid_op+0x1b/0x20 [ 72.349517] ? refcount_warn_saturate+0xfb/0x150 [ 72.349519] ? refcount_warn_saturate+0xfb/0x150 [ 72.349521] crypto_destroy_tfm+0x9b/0xe0 [ 72.349525] siw_exit_module+0xf6/0x590 [siw] So we need to set siw_crypto_shash to null in the failure path of siw_init_module. Signed-off-by: Guoqing Jiang <guoqing.jiang@linux.dev> --- drivers/infiniband/sw/siw/siw_main.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)