Skip to contentSkip to conversation

RDMA/siw: free siw_base_qp in kref release routine

PATCH Applied Krishnamraju Eraparaju 2 participants 2 messages Oct 7, 2019 – Oct 18, 2019

Subsystems (2)
InfiniBand Soft-iWARP driver (siw)
lore
Share & tools
lore

Krishnamraju Eraparaju

author
#0 lore raw

PATCH 1/1 RDMA/siw: free siw_base_qp in kref release routine

As siw_free_qp() is the last routine to access 'siw_base_qp' structure, freeing this structure early in siw_destroy_qp() could cause touch-after-free issue.
Hence, moved kfree(siw_base_qp) from siw_destroy_qp() to siw_free_qp().

Fixes 303ae1cdfdf7 ("rdma/siw: application interface")
Signed-off-by Krishnamraju Eraparaju <[email protected]>

---
v0 -> v1:
- added "Fixes" line.

---
 drivers/infiniband/sw/siw/siw_qp.c    | 2 ++
 drivers/infiniband/sw/siw/siw_verbs.c | 2 --
 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/infiniband/sw/siw/siw_qp.c +2 -0
index 430314c8abd9..c317f6e18ea8 100644
@@ -1305,6 +1305,7 @@ int siw_qp_add(struct siw_device *sdev, struct siw_qp *qp)
 void siw_free_qp(struct kref *ref)
 {
 	struct siw_qp *found, *qp = container_of(ref, struct siw_qp, ref);
+	struct siw_base_qp *siw_base_qp = to_siw_base_qp(qp->ib_qp);
 	struct siw_device *sdev = qp->sdev;
 	unsigned long flags;
 

@@ -1327,4 +1328,5 @@ void siw_free_qp(struct kref *ref)
 	atomic_dec(&sdev->num_qp);
 	siw_dbg_qp(qp, "free QP\n");
 	kfree_rcu(qp, rcu);
+	kfree(siw_base_qp);
 }
drivers/infiniband/sw/siw/siw_verbs.c +0 -2
index 869e02b69a01..b18a677832e1 100644
@@ -604,7 +604,6 @@ int siw_verbs_modify_qp(struct ib_qp *base_qp, struct ib_qp_attr *attr,
 int siw_destroy_qp(struct ib_qp *base_qp, struct ib_udata *udata)
 {
 	struct siw_qp *qp = to_siw_qp(base_qp);
-	struct siw_base_qp *siw_base_qp = to_siw_base_qp(base_qp);
 	struct siw_ucontext *uctx =
 		rdma_udata_to_drv_context(udata, struct siw_ucontext,
 					  base_ucontext);

@@ -641,7 +640,6 @@ int siw_destroy_qp(struct ib_qp *base_qp, struct ib_udata *udata)
 	qp->scq = qp->rcq = NULL;
 
 	siw_qp_put(qp);
-	kfree(siw_base_qp);
 
 	return 0;
 }
Signature · 1 line
2.23.0.rc0
Applied
#1 lore raw
Quoted 9 lines · Krishnamraju Eraparaju

As siw_free_qp() is the last routine to access 'siw_base_qp' structure,
freeing this structure early in siw_destroy_qp() could cause touch-after-free issue.
Hence, moved kfree(siw_base_qp) from siw_destroy_qp() to siw_free_qp().

Fixes 303ae1cdfdf7 ("rdma/siw: application interface")
Signed-off-by Krishnamraju Eraparaju <[email protected]>

Thanks, applied to for-rc.

Signature · 3 lines
Doug Ledford <[email protected]>
    GPG KeyID: B826A3330E572FDD
    Fingerprint = AE6B 1BDA 122B 23B4 265B  1274 B826 A333 0E57 2FDD