]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
RDMA/erdma: Prevent use-after-free in erdma_accept_newconn()
authorCheng Xu <chengyou@linux.alibaba.com>
Thu, 6 Mar 2025 12:04:40 +0000 (20:04 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 10 Apr 2025 12:33:34 +0000 (14:33 +0200)
commitbc1db4d8f1b0dc480d7d745a60a8cc94ce2badd4
treeb2def513b3838d70f6de7ce754991103187d5482
parent7844932c18ae69528b96fe6c93f12e7f06a9a47b
RDMA/erdma: Prevent use-after-free in erdma_accept_newconn()

[ Upstream commit 83437689249e6a17b25e27712fbee292e42e7855 ]

After the erdma_cep_put(new_cep) being called, new_cep will be freed,
and the following dereference will cause a UAF problem. Fix this issue.

Fixes: 920d93eac8b9 ("RDMA/erdma: Add connection management (CM) support")
Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
Signed-off-by: Cheng Xu <chengyou@linux.alibaba.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/infiniband/hw/erdma/erdma_cm.c