Commit 3b01fe7f authored by Jack Morgenstein's avatar Jack Morgenstein Committed by David S. Miller

net/mlx4_core: Use-after-free causes a resource leak in flow-steering detach

mlx4_QP_FLOW_STEERING_DETACH_wrapper first removes the steering
rule (which results in freeing the rule structure), and then
references a field in this struct (the qp number) when releasing the
busy-status on the rule's qp.

Since this memory was freed, it could reallocated and changed.
Therefore, the qp number in the struct may be incorrect,
so that we are releasing the incorrect qp. This leaves the rule's qp
in the busy state (and could possibly release an incorrect qp as well).

Fix this by saving the qp number in a local variable, for use after
removing the steering rule.

Fixes: 2c473ae7 ("net/mlx4_core: Disallow releasing VF QPs which have steering rules")
Signed-off-by: default avatarJack Morgenstein <jackm@dev.mellanox.co.il>
Signed-off-by: default avatarTariq Toukan <tariqt@mellanox.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent f0c16ba8
...@@ -4473,6 +4473,7 @@ int mlx4_QP_FLOW_STEERING_DETACH_wrapper(struct mlx4_dev *dev, int slave, ...@@ -4473,6 +4473,7 @@ int mlx4_QP_FLOW_STEERING_DETACH_wrapper(struct mlx4_dev *dev, int slave,
struct res_qp *rqp; struct res_qp *rqp;
struct res_fs_rule *rrule; struct res_fs_rule *rrule;
u64 mirr_reg_id; u64 mirr_reg_id;
int qpn;
if (dev->caps.steering_mode != if (dev->caps.steering_mode !=
MLX4_STEERING_MODE_DEVICE_MANAGED) MLX4_STEERING_MODE_DEVICE_MANAGED)
...@@ -4489,10 +4490,11 @@ int mlx4_QP_FLOW_STEERING_DETACH_wrapper(struct mlx4_dev *dev, int slave, ...@@ -4489,10 +4490,11 @@ int mlx4_QP_FLOW_STEERING_DETACH_wrapper(struct mlx4_dev *dev, int slave,
} }
mirr_reg_id = rrule->mirr_rule_id; mirr_reg_id = rrule->mirr_rule_id;
kfree(rrule->mirr_mbox); kfree(rrule->mirr_mbox);
qpn = rrule->qpn;
/* Release the rule form busy state before removal */ /* Release the rule form busy state before removal */
put_res(dev, slave, vhcr->in_param, RES_FS_RULE); put_res(dev, slave, vhcr->in_param, RES_FS_RULE);
err = get_res(dev, slave, rrule->qpn, RES_QP, &rqp); err = get_res(dev, slave, qpn, RES_QP, &rqp);
if (err) if (err)
return err; return err;
...@@ -4517,7 +4519,7 @@ int mlx4_QP_FLOW_STEERING_DETACH_wrapper(struct mlx4_dev *dev, int slave, ...@@ -4517,7 +4519,7 @@ int mlx4_QP_FLOW_STEERING_DETACH_wrapper(struct mlx4_dev *dev, int slave,
if (!err) if (!err)
atomic_dec(&rqp->ref_count); atomic_dec(&rqp->ref_count);
out: out:
put_res(dev, slave, rrule->qpn, RES_QP); put_res(dev, slave, qpn, RES_QP);
return err; return err;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment