[PATCH] RDMA/siw: Fix CEP use-after-free in siw_connect()

[PATCH] RDMA/siw: Fix CEP use-after-free in siw_connect()

[Shuangpeng Bai]

siw_connect() publishes a newly allocated CEP through qp->cep and gives
the QP an association reference.

If connection setup fails while the QP is being destroyed, QP teardown
can clear qp->cep and drop that reference first. The error path
nevertheless drops what it assumes is the association reference. This
consumes the local allocation reference and frees the CEP before the
error path updates cep->state and releases cep->in_use, causing a
use-after-free.

Serialize CEP association and error-side detachment with qp->state_lock.
Only drop the association reference when qp->cep still points to the CEP
being cleaned up, leaving the local reference valid until cleanup is
complete.

Fixes: 6c52fdc244b5 ("rdma/siw: connection management")
Cc: stable@vger.kernel.org
Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
---
 drivers/infiniband/sw/siw/siw_cm.c | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/drivers/infiniband/sw/siw/siw_cm.c b/drivers/infiniband/sw/siw/siw_cm.c
index 87c79527ac09..7b32158ea49f 100644
--- a/drivers/infiniband/sw/siw/siw_cm.c
+++ b/drivers/infiniband/sw/siw/siw_cm.c
@@ -1467,11 +1467,13 @@ int siw_connect(struct iw_cm_id *id, struct iw_cm_conn_param *params)
 	siw_cep_set_inuse(cep);
 
 	/* Associate QP with CEP */
+	down_write(&qp->state_lock);
 	siw_cep_get(cep);
 	qp->cep = cep;
 
 	/* siw_qp_get(qp) already done by QP lookup */
 	cep->qp = qp;
+	up_write(&qp->state_lock);
 
 	id->add_ref(id);
 	cep->cm_id = id;
@@ -1564,16 +1566,19 @@ int siw_connect(struct iw_cm_id *id, struct iw_cm_conn_param *params)
 		siw_socket_disassoc(s);
 		sock_release(s);
 
-		cep->qp = NULL;
-
 		cep->cm_id = NULL;
 		id->rem_ref(id);
 
-		qp->cep = NULL;
-		siw_cep_put(cep);
-
 		cep->state = SIW_EPSTATE_CLOSED;
 
+		down_write(&qp->state_lock);
+		cep->qp = NULL;
+		if (qp->cep == cep) {
+			qp->cep = NULL;
+			siw_cep_put(cep);
+		}
+		up_write(&qp->state_lock);
+
 		siw_cep_set_free_and_put(cep);
 
 	} else if (s) {
-- 
2.43.0