linux-kernel - [PATCH] RDMA/erdma: Prevent use-after-free in erdma_accept

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20a1a47c-8906-44e8-92e6-9b3e698b1491@web.de>
Date: Wed, 5 Mar 2025 15:20:41 +0100
From: Markus Elfring <Markus.Elfring@....de>
To: kernel-janitors@...r.kernel.org, linux-rdma@...r.kernel.org,
 Cheng Xu <chengyou@...ux.alibaba.com>, Jason Gunthorpe <jgg@...pe.ca>,
 Kai Shen <kaishen@...ux.alibaba.com>, Leon Romanovsky <leon@...nel.org>,
 Yang Li <yang.lee@...ux.alibaba.com>
Cc: cocci@...ia.fr, LKML <linux-kernel@...r.kernel.org>
Subject: [PATCH] RDMA/erdma: Prevent use-after-free in erdma_accept_newconn()

From: Markus Elfring <elfring@...rs.sourceforge.net>
Date: Wed, 5 Mar 2025 15:07:51 +0100

The implementation of the function “erdma_accept_newconn” contained
still the statement “new_cep->sock = NULL” after
the function call “erdma_cep_put(new_cep)”.
Thus delete an inappropriate reset action.

Reported-by: Cheng Xu <chengyou@...ux.alibaba.com>
Link: https://lore.kernel.org/cocci/167179d0-e1ea-39a8-4143-949ad57294c2@linux.alibaba.com/
Link: https://lkml.org/lkml/2023/3/19/191
Fixes: 920d93eac8b9 ("RDMA/erdma: Add connection management (CM) support")
Cc: stable@...r.kernel.org
Signed-off-by: Markus Elfring <elfring@...rs.sourceforge.net>
---
 drivers/infiniband/hw/erdma/erdma_cm.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/infiniband/hw/erdma/erdma_cm.c b/drivers/infiniband/hw/erdma/erdma_cm.c
index 1b23c698ec25..e0acc185e719 100644
--- a/drivers/infiniband/hw/erdma/erdma_cm.c
+++ b/drivers/infiniband/hw/erdma/erdma_cm.c
@@ -709,7 +709,6 @@ static void erdma_accept_newconn(struct erdma_cep *cep)
 		erdma_cancel_mpatimer(new_cep);

 		erdma_cep_put(new_cep);
-		new_cep->sock = NULL;
 	}

 	if (new_s) {
--
2.48.1