Re: Re: [PATCH] infiniband: Fix a use after free in isert_connect_request

[Leon Romanovsky]

On Mon, Mar 22, 2021 at 10:51:35PM +0800, lyl2019@xxxxxxxxxxxxxxxx wrote:
> 
> 
> 
> > -----原始邮件-----
> > 发件人: "Leon Romanovsky" <leon@xxxxxxxxxx>
> > 发送时间: 2021-03-22 22:27:17 (星期一)
> > 收件人: "Lv Yunlong" <lyl2019@xxxxxxxxxxxxxxxx>
> > 抄送: sagi@xxxxxxxxxxx, dledford@xxxxxxxxxx, jgg@xxxxxxxx, linux-rdma@xxxxxxxxxxxxxxx, target-devel@xxxxxxxxxxxxxxx, linux-kernel@xxxxxxxxxxxxxxx
> > 主题: Re: [PATCH] infiniband: Fix a use after free in isert_connect_request
> > 
> > On Mon, Mar 22, 2021 at 06:53:55AM -0700, Lv Yunlong wrote:
> > > The device is got by isert_device_get() with refcount is 1,
> > > and is assigned to isert_conn by isert_conn->device = device.
> > > When isert_create_qp() failed, device will be freed with
> > > isert_device_put().
> > > 
> > > Later, the device is used in isert_free_login_buf(isert_conn)
> > > by the isert_conn->device->ib_device statement. My patch
> > > exchanges the callees order to free the device late.
> > > 
> > > Signed-off-by: Lv Yunlong <lyl2019@xxxxxxxxxxxxxxxx>
> > > ---
> > >  drivers/infiniband/ulp/isert/ib_isert.c | 4 ++--
> > >  1 file changed, 2 insertions(+), 2 deletions(-)
> > 
> > The fix needs to be change of isert_free_login_buf() from
> > isert_free_login_buf(isert_conn) to be isert_free_login_buf(isert_conn, cma_id->device)
> > 
> > Thanks
> > 
> > > 
> > > diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
> > > index 7305ed8976c2..d8a533e346b0 100644
> > > --- a/drivers/infiniband/ulp/isert/ib_isert.c
> > > +++ b/drivers/infiniband/ulp/isert/ib_isert.c
> > > @@ -473,10 +473,10 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
> > >  
> > >  out_destroy_qp:
> > >  	isert_destroy_qp(isert_conn);
> > > -out_conn_dev:
> > > -	isert_device_put(device);
> > >  out_rsp_dma_map:
> > >  	isert_free_login_buf(isert_conn);
> > > +out_conn_dev:
> > > +	isert_device_put(device);
> > >  out:
> > >  	kfree(isert_conn);
> > >  	rdma_reject(cma_id, NULL, 0, IB_CM_REJ_CONSUMER_DEFINED);
> > > -- 
> > > 2.25.1
> > > 
> > > 
> 
> I see that function isert_free_login_buf(struct isert_conn *isert_conn) has only
> a parameter,  do you mean i need change the implementation of isert_free_login_buf?
> 
> I'm sorry to say that i am unfamilar with this module and afraid of making more mistakes,
> because this function is being called elsewhere as well.
> Could you help me to fix this issue? Or just fix it and tell me your commit number?

After checking how isert_connect_release() is implemented, it looks like
this will fix:

diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
index 7305ed8976c2..18266f07c58d 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.c
+++ b/drivers/infiniband/ulp/isert/ib_isert.c
@@ -438,23 +438,23 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
 	isert_init_conn(isert_conn);
 	isert_conn->cm_id = cma_id;
 
-	ret = isert_alloc_login_buf(isert_conn, cma_id->device);
-	if (ret)
-		goto out;
-
 	device = isert_device_get(cma_id);
 	if (IS_ERR(device)) {
 		ret = PTR_ERR(device);
-		goto out_rsp_dma_map;
+		goto out;
 	}
 	isert_conn->device = device;
 
+	ret = isert_alloc_login_buf(isert_conn, cma_id->device);
+	if (ret)
+		goto out_conn_dev;
+
 	isert_set_nego_params(isert_conn, &event->param.conn);
 
 	isert_conn->qp = isert_create_qp(isert_conn, cma_id);
 	if (IS_ERR(isert_conn->qp)) {
 		ret = PTR_ERR(isert_conn->qp);
-		goto out_conn_dev;
+		goto out_rsp_dma_map;
 	}
 
 	ret = isert_login_post_recv(isert_conn);
@@ -473,10 +473,10 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
 
 out_destroy_qp:
 	isert_destroy_qp(isert_conn);
-out_conn_dev:
-	isert_device_put(device);
 out_rsp_dma_map:
 	isert_free_login_buf(isert_conn);
+out_conn_dev:
+	isert_device_put(device);
 out:
 	kfree(isert_conn);
 	rdma_reject(cma_id, NULL, 0, IB_CM_REJ_CONSUMER_DEFINED);