| Message ID | 20250306120440.72792-1-chengyou@linux.alibaba.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 83437689249e6a17b25e27712fbee292e42e7855 |
| Headers | show |
| Series | [for-next] RDMA/erdma: Prevent use-after-free in erdma_accept_newconn() | expand |
> After the erdma_cep_put(new_cep) being called, new_cep will be freed, > and the following dereference will cause a UAF problem. Fix this issue. * Would a change description be nicer without an abbreviation? * Will any additional tags become helpful? + https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst?h=v6.14-rc5#n539 + See also: https://lore.kernel.org/cocci/20a1a47c-8906-44e8-92e6-9b3e698b1491@web.de/ https://sympa.inria.fr/sympa/arc/cocci/2025-03/msg00075.html https://lkml.org/lkml/2025/3/5/1100 Regards, Markus
On Thu, Mar 06, 2025 at 08:04:40PM +0800, Cheng Xu wrote: > After the erdma_cep_put(new_cep) being called, new_cep will be freed, > and the following dereference will cause a UAF problem. Fix this issue. > > Fixes: 920d93eac8b9 ("RDMA/erdma: Add connection management (CM) support") > Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> > Signed-off-by: Cheng Xu <chengyou@linux.alibaba.com> > --- > drivers/infiniband/hw/erdma/erdma_cm.c | 1 - > 1 file changed, 1 deletion(-) Applied as is. Thanks
diff --git a/drivers/infiniband/hw/erdma/erdma_cm.c b/drivers/infiniband/hw/erdma/erdma_cm.c index 1b23c698ec25..e0acc185e719 100644 --- a/drivers/infiniband/hw/erdma/erdma_cm.c +++ b/drivers/infiniband/hw/erdma/erdma_cm.c @@ -709,7 +709,6 @@ static void erdma_accept_newconn(struct erdma_cep *cep) erdma_cancel_mpatimer(new_cep); erdma_cep_put(new_cep); - new_cep->sock = NULL; } if (new_s) {
After the erdma_cep_put(new_cep) being called, new_cep will be freed, and the following dereference will cause a UAF problem. Fix this issue. Fixes: 920d93eac8b9 ("RDMA/erdma: Add connection management (CM) support") Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> Signed-off-by: Cheng Xu <chengyou@linux.alibaba.com> --- drivers/infiniband/hw/erdma/erdma_cm.c | 1 - 1 file changed, 1 deletion(-)