Re: [PATCH rdma-rc] RDMA/ucma: Fix use-after-free bug in ucma_create_uevent

[Leon Romanovsky <leon@kernel.org>]

On Wed, Jan 06, 2021 at 05:33:16PM -0400, Jason Gunthorpe wrote:
> On Wed, Jan 06, 2021 at 02:22:12PM +0200, Leon Romanovsky wrote:
> > diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
> > index da2512c30ffd..d6cd72ff213b 100644
> > +++ b/drivers/infiniband/core/ucma.c
> > @@ -1430,6 +1430,12 @@ static ssize_t ucma_notify(struct ucma_file *file, const char __user *inbuf,
> >  	return ret;
> >  }
> >
> > +static void ucma_flush_wq(struct rdma_cm_id *id)
> > +{
> > +	if (rdma_protocol_roce(id->device, id->port_num))
> > +		cma_flush_wq();
> > +}
>
> The problem here is that rdma_leave_multicast() does not cancel the
> work it created. It is a bug on the iboe side because the normal IB
> side does do the ib_sa_free_multicast() which cancels its callback.
>
> The fix is to add a cancel work to destroy_mc(), not queue flushing

In IB flow, we are storing work pointer so it will be possible to
cancel. This is not the case for the iboe, we simply don't know which
work to cancel.

We can cache that work inside "mc" too.

Thanks

>
> Jason