]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
RDMA/erdma: Prevent use-after-free in erdma_accept_newconn()
authorCheng Xu <chengyou@linux.alibaba.com>
Thu, 6 Mar 2025 12:04:40 +0000 (20:04 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 10 Apr 2025 12:37:31 +0000 (14:37 +0200)
commit667a628ab67d359166799fad89b3c6909599558a
treef2a7e6c46ca9f7a8b34de8383a6e4b349f4dbe23
parent68438629de34a351e15ab42240a8a0d131e51a25
RDMA/erdma: Prevent use-after-free in erdma_accept_newconn()

[ Upstream commit 83437689249e6a17b25e27712fbee292e42e7855 ]

After the erdma_cep_put(new_cep) being called, new_cep will be freed,
and the following dereference will cause a UAF problem. Fix this issue.

Fixes: 920d93eac8b9 ("RDMA/erdma: Add connection management (CM) support")
Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
Signed-off-by: Cheng Xu <chengyou@linux.alibaba.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/infiniband/hw/erdma/erdma_cm.c