linux/drivers/infiniband/ulp
Lv Yunlong adb76a520d IB/isert: Fix a use after free in isert_connect_request
The device is got by isert_device_get() with refcount is 1, and is
assigned to isert_conn by
  isert_conn->device = device.

When isert_create_qp() failed, device will be freed with
isert_device_put().

Later, the device is used in isert_free_login_buf(isert_conn) by the
isert_conn->device->ib_device statement.

Free the device in the correct order.

Fixes: ae9ea9ed38 ("iser-target: Split some logic in isert_connect_request to routines")
Link: https://lore.kernel.org/r/20210322161325.7491-1-lyl2019@mail.ustc.edu.cn
Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
Acked-by: Sagi Grimberg <sagi@grimberg.me>
Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
Reviewed-by: Max Gurtovoy <mgurtovoy@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2021-03-26 14:15:40 -03:00
..
ipoib RDMA: Support more than 255 rdma ports 2021-03-26 09:31:21 -03:00
iser IB/iser: Simplify prot_caps setting 2021-01-19 20:02:07 -04:00
isert IB/isert: Fix a use after free in isert_connect_request 2021-03-26 14:15:40 -03:00
opa_vnic RDMA: Convert comma to semicolon 2021-01-07 13:53:41 -04:00
rtrs RDMA/rtrs-clt: Use rdma_event_msg in log 2021-03-11 14:50:41 -04:00
srp RDMA/srp: Fix support for unpopulated and unbalanced NUMA nodes 2021-02-16 20:01:50 -04:00
srpt RDMA: Support more than 255 rdma ports 2021-03-26 09:31:21 -03:00
Makefile RDMA/rtrs: include client and server modules into kernel compilation 2020-05-17 18:57:15 -03:00