RDMA: Fix use-after-free in rxe_queue_cleanup
authorPavel Skripkin <paskripkin@gmail.com>
Sun, 21 Nov 2021 20:22:39 +0000 (23:22 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 17 Dec 2021 09:30:12 +0000 (10:30 +0100)
commitacb53e47db1fbc7cd37ab10b46388f045a76e383
tree405d66cd7451bce0f1566eb0db7eb41b1965562e
parentc0d44c58afdd56de3c223d92fcf3072721e87642
RDMA: Fix use-after-free in rxe_queue_cleanup

[ Upstream commit 84b01721e8042cdd1e8ffeb648844a09cd4213e0 ]

On error handling path in rxe_qp_from_init() qp->sq.queue is freed and
then rxe_create_qp() will drop last reference to this object. qp clean up
function will try to free this queue one time and it causes UAF bug.

Fix it by zeroing queue pointer after freeing queue in rxe_qp_from_init().

Fixes: 514aee660df4 ("RDMA: Globally allocate and release QP memory")
Link: https://lore.kernel.org/r/20211121202239.3129-1-paskripkin@gmail.com
Reported-by: syzbot+aab53008a5adf26abe91@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Reviewed-by: Zhu Yanjun <zyjzyj2000@gmail.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/infiniband/sw/rxe/rxe_qp.c