Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S937531AbdCJNoL (ORCPT ); Fri, 10 Mar 2017 08:44:11 -0500 Received: from shadbolt.e.decadent.org.uk ([88.96.1.126]:42916 "EHLO shadbolt.e.decadent.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S934294AbdCJLwX (ORCPT ); Fri, 10 Mar 2017 06:52:23 -0500 Content-Type: text/plain; charset="UTF-8" Content-Disposition: inline Content-Transfer-Encoding: 8bit MIME-Version: 1.0 From: Ben Hutchings To: linux-kernel@vger.kernel.org, stable@vger.kernel.org CC: akpm@linux-foundation.org, "Jack Morgenstein" , "Tariq Toukan" , "David S. Miller" Date: Fri, 10 Mar 2017 11:46:22 +0000 Message-ID: X-Mailer: LinuxStableQueue (scripts by bwh) Subject: [PATCH 3.16 130/370] net/mlx4_core: Use-after-free causes a resource leak in flow-steering detach In-Reply-To: X-SA-Exim-Connect-IP: 82.70.136.246 X-SA-Exim-Mail-From: ben@decadent.org.uk X-SA-Exim-Scanned: No (on shadbolt.decadent.org.uk); SAEximRunCond expanded to false Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2216 Lines: 62 3.16.42-rc1 review patch. If anyone has any objections, please let me know. ------------------ From: Jack Morgenstein commit 3b01fe7f91c8e4f9afc4fae3c5af72c14958d2d8 upstream. mlx4_QP_FLOW_STEERING_DETACH_wrapper first removes the steering rule (which results in freeing the rule structure), and then references a field in this struct (the qp number) when releasing the busy-status on the rule's qp. Since this memory was freed, it could reallocated and changed. Therefore, the qp number in the struct may be incorrect, so that we are releasing the incorrect qp. This leaves the rule's qp in the busy state (and could possibly release an incorrect qp as well). Fix this by saving the qp number in a local variable, for use after removing the steering rule. Fixes: 2c473ae7e582 ("net/mlx4_core: Disallow releasing VF QPs which have steering rules") Signed-off-by: Jack Morgenstein Signed-off-by: Tariq Toukan Signed-off-by: David S. Miller [bwh: Backported to 3.16: adjust context] Signed-off-by: Ben Hutchings --- drivers/net/ethernet/mellanox/mlx4/resource_tracker.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c +++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c @@ -4091,6 +4091,7 @@ int mlx4_QP_FLOW_STEERING_DETACH_wrapper int err; struct res_qp *rqp; struct res_fs_rule *rrule; + int qpn; if (dev->caps.steering_mode != MLX4_STEERING_MODE_DEVICE_MANAGED) @@ -4099,9 +4100,10 @@ int mlx4_QP_FLOW_STEERING_DETACH_wrapper err = get_res(dev, slave, vhcr->in_param, RES_FS_RULE, &rrule); if (err) return err; + qpn = rrule->qpn; /* Release the rule form busy state before removal */ put_res(dev, slave, vhcr->in_param, RES_FS_RULE); - err = get_res(dev, slave, rrule->qpn, RES_QP, &rqp); + err = get_res(dev, slave, qpn, RES_QP, &rqp); if (err) return err; @@ -4117,7 +4119,7 @@ int mlx4_QP_FLOW_STEERING_DETACH_wrapper if (!err) atomic_dec(&rqp->ref_count); out: - put_res(dev, slave, rrule->qpn, RES_QP); + put_res(dev, slave, qpn, RES_QP); return err; }