[PATCH] RDMA/erdma: Prevent use-after-free in erdma_accept_newconn()

[Markus Elfring]

From: Markus Elfring <elfring@xxxxxxxxxxxxxxxxxxxxx>
Date: Wed, 5 Mar 2025 15:07:51 +0100

The implementation of the function “erdma_accept_newconn” contained
still the statement “new_cep->sock = NULL” after
the function call “erdma_cep_put(new_cep)”.
Thus delete an inappropriate reset action.

Reported-by: Cheng Xu <chengyou@xxxxxxxxxxxxxxxxx>
Link: https://lore.kernel.org/cocci/167179d0-e1ea-39a8-4143-949ad57294c2@xxxxxxxxxxxxxxxxx/
Link: https://lkml.org/lkml/2023/3/19/191
Fixes: 920d93eac8b9 ("RDMA/erdma: Add connection management (CM) support")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Markus Elfring <elfring@xxxxxxxxxxxxxxxxxxxxx>
---
 drivers/infiniband/hw/erdma/erdma_cm.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/infiniband/hw/erdma/erdma_cm.c b/drivers/infiniband/hw/erdma/erdma_cm.c
index 1b23c698ec25..e0acc185e719 100644
--- a/drivers/infiniband/hw/erdma/erdma_cm.c
+++ b/drivers/infiniband/hw/erdma/erdma_cm.c
@@ -709,7 +709,6 @@ static void erdma_accept_newconn(struct erdma_cep *cep)
 		erdma_cancel_mpatimer(new_cep);

 		erdma_cep_put(new_cep);
-		new_cep->sock = NULL;
 	}

 	if (new_s) {
--
2.48.1