2021-12-07 16:08:18

by Shiraz Saleem

Subject: [PATCH for-rc] RDMA/irdma: Fix a user-after-free in add_pble_prm

When irdma_hmc_sd_one fails, 'chunk' is freed while its still on the PBLE
info list.

Add the chunk entry to the PBLE info list only after successful setting of
the SD in irdma_hmc_sd_one.

Fixes: e8c4dbc2fcac ("RDMA/irdma: Add PBLE resource manager")
Reported-by: Dan Carpenter <[email protected]>
Signed-off-by: Shiraz Saleem <[email protected]>
---
drivers/infiniband/hw/irdma/pble.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/infiniband/hw/irdma/pble.c b/drivers/infiniband/hw/irdma/pble.c
index aeeb1c3..da032b9 100644
--- a/drivers/infiniband/hw/irdma/pble.c
+++ b/drivers/infiniband/hw/irdma/pble.c
@@ -283,7 +283,6 @@ static enum irdma_sd_entry_type irdma_get_type(struct irdma_sc_dev *dev,
"PBLE: next_fpm_addr = %llx chunk_size[%llu] = 0x%llx\n",
pble_rsrc->next_fpm_addr, chunk->size, chunk->size);
pble_rsrc->unallocated_pble -= (u32)(chunk->size >> 3);
- list_add(&chunk->list, &pble_rsrc->pinfo.clist);
sd_reg_val = (sd_entry_type == IRDMA_SD_TYPE_PAGED) ?
sd_entry->u.pd_table.pd_page_addr.pa :
sd_entry->u.bp.addr.pa;
@@ -295,6 +294,7 @@ static enum irdma_sd_entry_type irdma_get_type(struct irdma_sc_dev *dev,
goto error;
}

+ list_add(&chunk->list, &pble_rsrc->pinfo.clist);
sd_entry->valid = true;
return 0;

--
1.8.3.1

2021-12-07 17:51:02

by Jason Gunthorpe

Subject: Re: [PATCH for-rc] RDMA/irdma: Fix a user-after-free in add_pble_prm

On Tue, Dec 07, 2021 at 09:21:36AM -0600, Shiraz Saleem wrote:
> When irdma_hmc_sd_one fails, 'chunk' is freed while its still on the PBLE
> info list.
>
> Add the chunk entry to the PBLE info list only after successful setting of
> the SD in irdma_hmc_sd_one.
>
> Fixes: e8c4dbc2fcac ("RDMA/irdma: Add PBLE resource manager")
> Reported-by: Dan Carpenter <[email protected]>
> Signed-off-by: Shiraz Saleem <[email protected]>
> ---
> drivers/infiniband/hw/irdma/pble.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)

Applied to for-rc, thanks

Jason