diff options
| author | Chengchang Tang <tangchengchang@huawei.com> | 2024-04-12 12:16:11 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2024-05-30 10:49:43 +0300 |
| commit | 39d26cf46306bdc7ae809ecfdbfeff5aa1098911 (patch) | |
| tree | 7db64dba73269507c69fbbd7997dea23b19c1b5e /drivers/infiniband/hw/mlx5 | |
| parent | 72dc542f0d8977e7d41d610db6bb65c47cad43e9 (diff) | |
| download | linux-39d26cf46306bdc7ae809ecfdbfeff5aa1098911.tar.xz | |
RDMA/hns: Fix UAF for cq async event
[ Upstream commit a942ec2745ca864cd8512142100e4027dc306a42 ]
The refcount of CQ is not protected by locks. When CQ asynchronous
events and CQ destruction are concurrent, CQ may have been released,
which will cause UAF.
Use the xa_lock() to protect the CQ refcount.
Fixes: 9a4435375cd1 ("IB/hns: Add driver files for hns RoCE driver")
Signed-off-by: Chengchang Tang <tangchengchang@huawei.com>
Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com>
Link: https://lore.kernel.org/r/20240412091616.370789-6-huangjunxian6@hisilicon.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'drivers/infiniband/hw/mlx5')
0 files changed, 0 insertions, 0 deletions