Re: [PATCH] RDMA/hns: Fix UAF for cq async event

Jason Gunthorpe
2024-09-20T12:57:50Z

On Fri, Sep 20, 2024 at 08:45:40PM +0800, haixiao.yan.cn@windriver.com wrote:
> From: Chengchang Tang <tangchengchang@huawei.com>
>
> [ Upstream commit a942ec2745ca864cd8512142100e4027dc306a42 ]
>
> The refcount of CQ is not protected by locks. When CQ asynchronous
> events and CQ destruction are concurrent, CQ may have been released,
> which will cause UAF.
>
> Use the xa_lock() to protect the CQ refcount.
>
> Fixes: 9a4435375cd1 ("IB/hns: Add driver files for hns RoCE driver")
> Signed-off-by: Chengchang Tang <tangchengchang@huawei.com>
> Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com>
> Link: https://lore.kernel.org/r/20240412091616.370789-6-huangjunxian6@hisilicon.com
> Signed-off-by: Leon Romanovsky <leon@kernel.org>
> Signed-off-by: Haixiao Yan <haixiao.yan.cn@windriver.com>
> ---
> This commit is backporting a942ec2745ca to the branch linux-5.15.y to
> solve the CVE-2024-38545. Please merge this commit to linux-5.15.y.

Don't you need to send this to the stable maintainers too?

Jason