]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
RDMA/srpt: Do not register event handler until srpt device is fully setup
authorWilliam Kucharski <william.kucharski@oracle.com>
Fri, 2 Feb 2024 09:15:49 +0000 (02:15 -0700)
committerSasha Levin <sashal@kernel.org>
Tue, 26 Mar 2024 22:19:58 +0000 (18:19 -0400)
commit85570b91e4820a0db9d9432098778cafafa7d217
tree2aa84cd43b04a297ef616053b821972a85caba29
parentb9ad0e9217a1703479cf8d75a2893386159cc0ca
RDMA/srpt: Do not register event handler until srpt device is fully setup

[ Upstream commit c21a8870c98611e8f892511825c9607f1e2cd456 ]

Upon rare occasions, KASAN reports a use-after-free Write
in srpt_refresh_port().

This seems to be because an event handler is registered before the
srpt device is fully setup and a race condition upon error may leave a
partially setup event handler in place.

Instead, only register the event handler after srpt device initialization
is complete.

Fixes: a42d985bd5b2 ("ib_srpt: Initial SRP Target merge for v3.3-rc1")
Signed-off-by: William Kucharski <william.kucharski@oracle.com>
Link: https://lore.kernel.org/r/20240202091549.991784-2-william.kucharski@oracle.com
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/infiniband/ulp/srpt/ib_srpt.c