[PATCH rdma-rc] RDMA/siw: Fix use-after-free in siw_mem_id2obj()

[Deep Shah]

siw_mem_id2obj() finds a siw_mem with xa_load() under rcu_read_lock()
and then takes a reference with kref_get_unless_zero(). This is only
safe if the object stays allocated until RCU readers are done with it.
siw_free_mem() frees it with kfree() as soon as the last reference is
dropped, so a lookup that races with the final put reads freed memory.

This happens when an MR is deregistered while an incoming RDMA WRITE
looks up its STag:

  BUG: KASAN: slab-use-after-free in siw_mem_id2obj+0xe5/0x310
  Read of size 4 at addr ff110001042aed88 by task repro-rcu2/90
  Call Trace:
   <IRQ>
   siw_mem_id2obj+0xe5/0x310
   siw_proc_write+0x282/0x430
   siw_tcp_rx_data+0x12e/0xbf0
   __tcp_read_sock+0x12c/0x440
   siw_qp_llp_data_ready+0x147/0x260
  Allocated by task 89:
   siw_mr_add_mem+0xb2/0x2a0
   siw_reg_user_mr+0x19f/0x380
   ib_uverbs_reg_mr+0x2a7/0x4c0
  Freed by task 89:
   kfree+0x301/0x530
   siw_dereg_mr+0x31/0x50
   ib_dereg_mr_user+0xb9/0x200

Free siw_mem with kfree_rcu(). A lookup that loses the race then sees
a zero refcount and fails. The umem or PBL is still released at the
last put, since a failed lookup never touches it.

Fixes: 2251334dcac9 ("rdma/siw: application buffer management")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Deep Shah <deepshah146@xxxxxxxxx>
---
 drivers/infiniband/sw/siw/siw.h     | 1 +
 drivers/infiniband/sw/siw/siw_mem.c | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/infiniband/sw/siw/siw.h b/drivers/infiniband/sw/siw/siw.h
index dbc998248b1e..4ec9c2ac75e7 100644
--- a/drivers/infiniband/sw/siw/siw.h
+++ b/drivers/infiniband/sw/siw/siw.h
@@ -157,6 +157,7 @@ struct siw_mem {
 		void *mem_obj;
 	};
 	struct ib_pd *pd;
+	struct rcu_head rcu;
 };
 
 struct siw_mr {
diff --git a/drivers/infiniband/sw/siw/siw_mem.c b/drivers/infiniband/sw/siw/siw_mem.c
index 2a08817d3cce..be70dc9c8f81 100644
--- a/drivers/infiniband/sw/siw/siw_mem.c
+++ b/drivers/infiniband/sw/siw/siw_mem.c
@@ -115,7 +115,7 @@ void siw_free_mem(struct kref *ref)
 		else
 			kfree(mem->pbl);
 	}
-	kfree(mem);
+	kfree_rcu(mem, rcu);
 }
 
 /*