Bart Van Assche 7f25f296fc RDMA/iwcm: Fix a use-after-free related to destroying CM IDs ... commit aee2424246 upstream. iw_conn_req_handler() associates a new struct rdma_id_private (conn_id) with an existing struct iw_cm_id (cm_id) as follows: conn_id->cm_id.iw = cm_id; cm_id->context = conn_id; cm_id->cm_handler = cma_iw_handler; rdma_destroy_id() frees both the cm_id and the struct rdma_id_private. Make sure that cm_work_handler() does not trigger a use-after-free by only freeing of the struct rdma_id_private after all pending work has finished. Cc: stable@vger.kernel.org Fixes: 59c68ac31e ("iw_cm: free cm_id resources on the last deref") Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev> Tested-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@wdc.com> Signed-off-by: Bart Van Assche <bvanassche@acm.org> Link: https://lore.kernel.org/r/20240605145117.397751-6-bvanassche@acm.org Signed-off-by: Leon Romanovsky <leon@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2024-08-19 05:33:39 +02:00
..
core	RDMA/iwcm: Fix a use-after-free related to destroying CM IDs	2024-08-19 05:33:39 +02:00
hw	bnxt_re: Fix imm_data endianness	2024-08-19 05:33:34 +02:00
sw	RDMA/rxe: Don't set BTH_ACK_MASK for UC or UD QPs	2024-08-19 05:33:33 +02:00
ulp	RDMA/IPoIB: Fix format truncation compilation errors	2024-06-16 13:28:40 +02:00
Kconfig	RMDA/sw: Don't allow drivers using dma_virt_ops on highmem configs	2020-11-24 13:29:05 +01:00
Makefile	treewide: Add SPDX license identifier - Makefile/Kconfig	2019-05-21 10:50:46 +02:00