Re: [PATCH 3/3] RDMA/srpt: Fix a use-after-free

[Leon Romanovsky <leonro@mellanox.com>]

On Tue, Jul 26, 2022 at 02:21:56PM -0700, Bart Van Assche wrote:
> Change the LIO port members inside struct srpt_port from regular members
> into pointers. Allocate the LIO port data structures from inside
> srpt_make_tport() and free these from inside srpt_make_tport(). Keep struct
> srpt_device as long as either an RDMA port or a LIO target port is
> associated with it. This patch decouples the lifetime of struct srpt_port
> (controlled by the RDMA core) and struct srpt_port_id (controlled by LIO).
> This patch fixes the following KASAN complaint:
> 
> BUG: KASAN: use-after-free in srpt_enable_tpg+0x31/0x70 [ib_srpt]
> Read of size 8 at addr ffff888141cc34b8 by task check/5093
> 
> Call Trace:
>  <TASK>
>  show_stack+0x4e/0x53
>  dump_stack_lvl+0x51/0x66
>  print_address_description.constprop.0.cold+0xea/0x41e
>  print_report.cold+0x90/0x205
>  kasan_report+0xb9/0xf0
>  __asan_load8+0x69/0x90
>  srpt_enable_tpg+0x31/0x70 [ib_srpt]
>  target_fabric_tpg_base_enable_store+0xe2/0x140 [target_core_mod]
>  configfs_write_iter+0x18b/0x210
>  new_sync_write+0x1f2/0x2f0
>  vfs_write+0x3e3/0x540
>  ksys_write+0xbb/0x140
>  __x64_sys_write+0x42/0x50
>  do_syscall_64+0x34/0x80
>  entry_SYSCALL_64_after_hwframe+0x46/0xb0
>  </TASK>
> 
> Reported-by: Li Zhijian <lizhijian@fujitsu.com>
> Cc: Li Zhijian <lizhijian@fujitsu.com>
> Cc: Hillf Danton <hdanton@sina.com>
> Cc: Mike Christie <michael.christie@oracle.com>
> Signed-off-by: Bart Van Assche <bvanassche@acm.org>
> ---
>  drivers/infiniband/ulp/srpt/ib_srpt.c | 133 ++++++++++++++++++--------
>  drivers/infiniband/ulp/srpt/ib_srpt.h |  10 +-
>  2 files changed, 96 insertions(+), 47 deletions(-)

Bart,

Please no BUG_ON() in new code.

Thanks