From: Mustafa Ismail Date: Tue, 5 Jul 2022 23:08:13 +0000 (-0500) Subject: RDMA/irdma: Fix a window for use-after-free X-Git-Tag: v5.15.73~1306 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=92520864ef9f912f38b403d172a0ded020683d55;p=platform%2Fkernel%2Flinux-rpi.git RDMA/irdma: Fix a window for use-after-free [ Upstream commit 8ecef7890b3aea78c8bbb501a4b5b8134367b821 ] During a destroy CQ an interrupt may cause processing of a CQE after CQ resources are freed by irdma_cq_free_rsrc(). Fix this by moving the call to irdma_cq_free_rsrc() after the irdma_sc_cleanup_ceqes(), which is called under the cq_lock. Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs") Link: https://lore.kernel.org/r/20220705230815.265-6-shiraz.saleem@intel.com Signed-off-by: Bartosz Sobczak Signed-off-by: Mustafa Ismail Signed-off-by: Shiraz Saleem Signed-off-by: Leon Romanovsky Signed-off-by: Sasha Levin --- diff --git a/drivers/infiniband/hw/irdma/verbs.c b/drivers/infiniband/hw/irdma/verbs.c index 0eef464..cac4fb2 100644 --- a/drivers/infiniband/hw/irdma/verbs.c +++ b/drivers/infiniband/hw/irdma/verbs.c @@ -1759,11 +1759,11 @@ static int irdma_destroy_cq(struct ib_cq *ib_cq, struct ib_udata *udata) spin_unlock_irqrestore(&iwcq->lock, flags); irdma_cq_wq_destroy(iwdev->rf, cq); - irdma_cq_free_rsrc(iwdev->rf, iwcq); spin_lock_irqsave(&iwceq->ce_lock, flags); irdma_sc_cleanup_ceqes(cq, ceq); spin_unlock_irqrestore(&iwceq->ce_lock, flags); + irdma_cq_free_rsrc(iwdev->rf, iwcq); return 0; }