Re: [PATCH v1] RDMA/iwpm: Fix use-after-free in mapping info dump

[sashiko-bot@kernel.org]

> iwpm_send_mapinfo() walks the mapinfo hash table while holding
> iwpm_mapinfo_lock, but when the current skb is full it temporarily drops
> that lock to send the skb and allocate another one.  The hlist iterator is
> not protected across that window:
> 
> CPU0                                                CPU1
> iwpm_send_mapinfo()
> spin_lock_irqsave(&iwpm_mapinfo_lock, flags)
> hlist_for_each_entry(..., map_info, ...)
>   map_info points at map_info A
>   fill the current skb
>   spin_unlock_irqrestore(&iwpm_mapinfo_lock,flags)
>   send the skb / allocate the next skb
>                                                     iwpm_remove_mapinfo()
>                                                     spin_lock_irqsave(&iwpm_mapinfo_lock,flags)
> [ ... ]
> infrastructure, the issue was not observed at runtime.
> 
> Fixes: 30dc5e63d6a5 ("RDMA/core: Add support for iWARP Port Mapper user space service")
> Assisted-by: Coccinelle
> Signed-off-by: Binbin Deng <18983559317@163.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261102081813.37754-1-18983559317@163.com?part=1