diff options
| author | Bernard Metzler <bernard.metzler@linux.dev> | 2026-06-04 19:08:08 +0300 |
|---|---|---|
| committer | Jason Gunthorpe <jgg@nvidia.com> | 2026-06-05 20:25:52 +0300 |
| commit | ea4f6f6c53577fb3f05dbd78b15e586772d49831 (patch) | |
| tree | 01c7163d5874a7db24e274648c8cd5ca4c8e71fc /include/linux/errqueue.h | |
| parent | 1521d560b7a1a39e437d37fffd9b55435d329ad1 (diff) | |
| download | linux-ea4f6f6c53577fb3f05dbd78b15e586772d49831.tar.xz | |
RDMA/siw: Fix endpoint/socket association handling
Disassociating a socket from an endpoint via siw_socket_disassoc() may
release the last reference on that endpoint and free it. Therefore, don't
clear the endpoints socket pointer after calling that function, but
within.
This fixes a:
BUG: KASAN: slab-use-after-free in siw_cm_work_handler (drivers/infiniband/sw/siw/siw_cm.c:1053 drivers/infiniband/sw/siw/siw_cm.c:1075)
which occurred after processing a malformed MPA request during connection
establishment, causing the new endpoint to be closed.
Fixes: 6c52fdc244b5c ("rdma/siw: connection management")
Link: https://patch.msgid.link/r/20260604160808.30948-1-bernard.metzler@linux.dev
Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
Signed-off-by: Bernard Metzler <bernard.metzler@linux.dev>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Diffstat (limited to 'include/linux/errqueue.h')
0 files changed, 0 insertions, 0 deletions