[PATCH rdma-next] RDMA/core: Fix use after free and refcnt leak on ndev in_device in iwarp_query_port

[PATCH rdma-next] RDMA/core: Fix use after free and refcnt leak on ndev in_device in iwarp_query_port

[Michal Kalderon]

If an iWARP driver is probed and removed while there are no ips
set for the device, it will lead to a reference count leak on
the inet device of the netdevice.

In addition, the netdevice was accessed after already calling
netdev_put, which could lead to using the netdev after already
freed.

Fixes: 4929116bdf72 ("RDMA/core: Add common iWARP query port")
Signed-off-by: Ariel Elior <ariel.elior@marvell.com>
Signed-off-by: Michal Kalderon <michal.kalderon@marvell.com>
---
 drivers/infiniband/core/device.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
index 99c4a55545cf..2dd2cfe9b561 100644
--- a/drivers/infiniband/core/device.c
+++ b/drivers/infiniband/core/device.c
@@ -1987,8 +1987,6 @@ static int iw_query_port(struct ib_device *device,
 	if (!netdev)
 		return -ENODEV;
 
-	dev_put(netdev);
-
 	port_attr->max_mtu = IB_MTU_4096;
 	port_attr->active_mtu = ib_mtu_int_to_enum(netdev->mtu);
 
@@ -1996,19 +1994,22 @@ static int iw_query_port(struct ib_device *device,
 		port_attr->state = IB_PORT_DOWN;
 		port_attr->phys_state = IB_PORT_PHYS_STATE_DISABLED;
 	} else {
-		inetdev = in_dev_get(netdev);
+		rcu_read_lock();
+		inetdev = __in_dev_get_rcu(netdev);
 
 		if (inetdev && inetdev->ifa_list) {
 			port_attr->state = IB_PORT_ACTIVE;
 			port_attr->phys_state = IB_PORT_PHYS_STATE_LINK_UP;
-			in_dev_put(inetdev);
 		} else {
 			port_attr->state = IB_PORT_INIT;
 			port_attr->phys_state =
 				IB_PORT_PHYS_STATE_PORT_CONFIGURATION_TRAINING;
 		}
+
+		rcu_read_unlock();
 	}
 
+	dev_put(netdev);
 	err = device->ops.query_port(device, port_num, port_attr);
 	if (err)
 		return err;
-- 
2.20.1

RE: [PATCH rdma-next] RDMA/core: Fix use after free and refcnt leak on ndev in_device in iwarp_query_port

[Saleem, Shiraz]

> Subject: [PATCH rdma-next] RDMA/core: Fix use after free and refcnt leak on ndev
> in_device in iwarp_query_port
> 
> If an iWARP driver is probed and removed while there are no ips set for the device,
> it will lead to a reference count leak on the inet device of the netdevice.
> 
> In addition, the netdevice was accessed after already calling netdev_put, which
> could lead to using the netdev after already freed.
> 
> Fixes: 4929116bdf72 ("RDMA/core: Add common iWARP query port")
> Signed-off-by: Ariel Elior <ariel.elior@marvell.com>
> Signed-off-by: Michal Kalderon <michal.kalderon@marvell.com>
> ---

Looks ok. Thanks!

Reviewed-by: Shiraz Saleem <shiraz.saleem@intel.com>

Re: [PATCH rdma-next] RDMA/core: Fix use after free and refcnt leak on ndev in_device in iwarp_query_port

[Kamal Heib]

On Wed, Sep 25, 2019 at 03:33:32PM +0300, Michal Kalderon wrote:
> If an iWARP driver is probed and removed while there are no ips
> set for the device, it will lead to a reference count leak on
> the inet device of the netdevice.
> 
> In addition, the netdevice was accessed after already calling
> netdev_put, which could lead to using the netdev after already
> freed.
> 
> Fixes: 4929116bdf72 ("RDMA/core: Add common iWARP query port")
> Signed-off-by: Ariel Elior <ariel.elior@marvell.com>
> Signed-off-by: Michal Kalderon <michal.kalderon@marvell.com>
> ---

Thanks!

Reviewed-by: Kamal Heib <kamalheib1@gmail.com>

Re: [PATCH rdma-next] RDMA/core: Fix use after free and refcnt leak on ndev in_device in iwarp_query_port

[Jason Gunthorpe]

On Wed, Sep 25, 2019 at 03:33:32PM +0300, Michal Kalderon wrote:
> If an iWARP driver is probed and removed while there are no ips
> set for the device, it will lead to a reference count leak on
> the inet device of the netdevice.
> 
> In addition, the netdevice was accessed after already calling
> netdev_put, which could lead to using the netdev after already
> freed.
> 
> Fixes: 4929116bdf72 ("RDMA/core: Add common iWARP query port")
> Signed-off-by: Ariel Elior <ariel.elior@marvell.com>
> Signed-off-by: Michal Kalderon <michal.kalderon@marvell.com>
> Reviewed-by: Shiraz Saleem <shiraz.saleem@intel.com>
> Reviewed-by: Kamal Heib <kamalheib1@gmail.com>
> ---
>  drivers/infiniband/core/device.c | 9 +++++----
>  1 file changed, 5 insertions(+), 4 deletions(-)

Applied to for-rc, thanks

Jason