Commit 83437689 authored by Cheng Xu's avatar Cheng Xu Committed by Leon Romanovsky
Browse files

RDMA/erdma: Prevent use-after-free in erdma_accept_newconn() 



After the erdma_cep_put(new_cep) being called, new_cep will be freed,
and the following dereference will cause a UAF problem. Fix this issue.

Fixes: 920d93ea ("RDMA/erdma: Add connection management (CM) support")
Signed-off-by: default avatarMarkus Elfring <elfring@users.sourceforge.net>
Signed-off-by: default avatarCheng Xu <chengyou@linux.alibaba.com>
Signed-off-by: default avatarLeon Romanovsky <leon@kernel.org>
parent 0b27b0e4

drivers/infiniband/hw/erdma/erdma_cm.c

+0 −1
Original line number Diff line number Diff line
@@ -709,7 +709,6 @@ static void erdma_accept_newconn(struct erdma_cep *cep) 
		erdma_cancel_mpatimer(new_cep);



		erdma_cep_put(new_cep);

		new_cep->sock = NULL;

	}



	if (new_s) {