Commit 0cba0efc authored Feb 14, 2018 by Leon Romanovsky Committed by Jason Gunthorpe Feb 15, 2018

RDMA/restrack: Increment CQ restrack object before committing



Once the uobj is committed it is immediately possible another thread
could destroy it, which worst case, can result in a use-after-free
of the restrack objects.

Cc: syzkaller <syzkaller@googlegroups.com>
Fixes: 08f294a1 ("RDMA/core: Add resource tracking for create and destroy CQs")
Reported-by: Noa Osherovich <noaos@mellanox.com>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>

parent 3f802b16

drivers/infiniband/core/uverbs_cmd.c

+3 −3

Original line number	Diff line number	Diff line
		@@ -1030,14 +1030,14 @@ static struct ib_ucq_object create_cq(struct ib_uverbs_file file,
		resp.response_length = offsetof(typeof(resp), response_length) +
		sizeof(resp.response_length);

		cq->res.type = RDMA_RESTRACK_CQ;
		rdma_restrack_add(&cq->res);

		ret = cb(file, obj, &resp, ucore, context);
		if (ret)
		goto err_cb;

		uobj_alloc_commit(&obj->uobject);
		cq->res.type = RDMA_RESTRACK_CQ;
		rdma_restrack_add(&cq->res);

		return obj;

		err_cb: