]> git.dujemihanovic.xyz Git - linux.git/commit
RDMA/irdma: Prevent QP use after free
authorMustafa Ismail <mustafa.ismail@intel.com>
Mon, 22 May 2023 15:56:53 +0000 (10:56 -0500)
committerJason Gunthorpe <jgg@nvidia.com>
Mon, 29 May 2023 17:06:29 +0000 (14:06 -0300)
commitc8f304d75f6c6cc679a73f89591f9a915da38f09
tree02c545d91caedbaa6d2886a145241544cc4253cb
parentffe14de983252862c91ad23bd5ca72fd9398d0e6
RDMA/irdma: Prevent QP use after free

There is a window where the poll cq may use a QP that has been freed.
This can happen if a CQE is polled before irdma_clean_cqes() can clear the
CQE's related to the QP and the destroy QP races to free the QP memory.
then the QP structures are used in irdma_poll_cq.  Fix this by moving the
clearing of CQE's before the reference is removed and the QP is destroyed.

Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs")
Link: https://lore.kernel.org/r/20230522155654.1309-3-shiraz.saleem@intel.com
Signed-off-by: Mustafa Ismail <mustafa.ismail@intel.com>
Signed-off-by: Shiraz Saleem <shiraz.saleem@intel.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
drivers/infiniband/hw/irdma/verbs.c