]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
RDMA/hns: Fix UAF for cq async event
authorChengchang Tang <tangchengchang@huawei.com>
Fri, 11 Oct 2024 10:22:15 +0000 (18:22 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 17 Oct 2024 13:11:58 +0000 (15:11 +0200)
commit330c825e66ef65278e4ebe57fd49c1d6f3f4e34e
treeb4e83b1f4419c2af1acbbd2c8a386d7073a6f9d1
parent5e336384cc9b608e0551f99c3d87316ca3b0e51a
RDMA/hns: Fix UAF for cq async event

[ Upstream commit a942ec2745ca864cd8512142100e4027dc306a42 ]

The refcount of CQ is not protected by locks. When CQ asynchronous
events and CQ destruction are concurrent, CQ may have been released,
which will cause UAF.

Use the xa_lock() to protect the CQ refcount.

Fixes: 9a4435375cd1 ("IB/hns: Add driver files for hns RoCE driver")
Signed-off-by: Chengchang Tang <tangchengchang@huawei.com>
Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com>
Link: https://lore.kernel.org/r/20240412091616.370789-6-huangjunxian6@hisilicon.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Haixiao Yan <haixiao.yan.cn@windriver.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/infiniband/hw/hns/hns_roce_cq.c