RDMA/erdma: Prevent use-after-free in erdma_accept_newconn()

hz-cheng · rleon · commit 83437689249e · 2025-03-06T08:25:38.000-05:00
After the erdma_cep_put(new_cep) being called, new_cep will be freed, and the following dereference will cause a UAF problem. Fix this issue. Fixes: 920d93e ("RDMA/erdma: Add connection management (CM) support") Signed-off-by: Markus Elfring <elfring@users.sourceforge.net> Signed-off-by: Cheng Xu <chengyou@linux.alibaba.com> Signed-off-by: Leon Romanovsky <leon@kernel.org>
diff --git a/drivers/infiniband/hw/erdma/erdma_cm.c b/drivers/infiniband/hw/erdma/erdma_cm.c
@@ -709,7 +709,6 @@ static void erdma_accept_newconn(struct erdma_cep *cep)
 		erdma_cancel_mpatimer(new_cep);
 
 		erdma_cep_put(new_cep);
-		new_cep->sock = NULL;
 	}
 
 	if (new_s) {

Original file line number	Diff line number	Diff line change
`@@ -709,7 +709,6 @@ static void erdma_accept_newconn(struct erdma_cep *cep)`
`709`	`709`	`erdma_cancel_mpatimer(new_cep);`
`710`	`710`
`711`	`711`	`erdma_cep_put(new_cep);`
`712`		`- new_cep->sock = NULL;`
`713`	`712`	`}`
`714`	`713`
`715`	`714`	`if (new_s) {`