Bug 264650 - RDMA/ucma: Fix use-after-free access in ucma_close
Summary: RDMA/ucma: Fix use-after-free access in ucma_close
Status: Closed FIXED
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: Unspecified
Hardware: Any Any
: --- Affects Only Me
Assignee: Hans Petter Selasky
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2022-06-13 02:43 UTC by xiaohuizhang
Modified: 2022-06-20 11:13 UTC (History)
2 users (show)

See Also:

Attachments
a possible patch (1.08 KB, application/mbox)
2022-06-13 02:43 UTC, xiaohuizhang 		no flags Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description xiaohuizhang 2022-06-13 02:43:31 UTC 
Created attachment 234656 [details]
a possible patch

The error in ucma_create_id() left ctx in the list of contexts belong
to ucma file descriptor. The attempt to close this file descriptor causes
to use-after-free accesses while iterating over such list.
Comment 1 commit-hook freebsd_committer freebsd_triage 2022-06-13 15:07:25 UTC 
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=66a0bc2105e43e54abfaa9f48b76c28371fa2d62

commit 66a0bc2105e43e54abfaa9f48b76c28371fa2d62
Author:     Hans Petter Selasky <hselasky@FreeBSD.org>
AuthorDate: 2022-06-13 14:55:14 +0000
Commit:     Hans Petter Selasky <hselasky@FreeBSD.org>
CommitDate: 2022-06-13 15:00:16 +0000

    ibcore: Fix use-after-free access in ucma_close()

    The error in ucma_create_id() left ctx in the list of contexts belong
    to ucma file descriptor. The attempt to close this file descriptor causes
    to use-after-free accesses while iterating over such list.

    Linux commit:
    ed65a4dc22083e73bac599ded6a262318cad7baf

    PR:             264650
    MFC after:      1 week
    Sponsored by:   NVIDIA Networking

 sys/ofed/drivers/infiniband/core/ib_ucma.c | 3 +++
 1 file changed, 3 insertions(+)
Comment 2 Hans Petter Selasky freebsd_committer freebsd_triage 2022-06-13 15:08:41 UTC 
Thank you for the submission!

--HPS
Comment 3 commit-hook freebsd_committer freebsd_triage 2022-06-20 11:13:26 UTC 
A commit in branch stable/13 references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=e212dffaae152cbb13f556c663a498ccf61c5889

commit e212dffaae152cbb13f556c663a498ccf61c5889
Author:     Hans Petter Selasky <hselasky@FreeBSD.org>
AuthorDate: 2022-06-13 14:55:14 +0000
Commit:     Hans Petter Selasky <hselasky@FreeBSD.org>
CommitDate: 2022-06-20 11:08:39 +0000

    ibcore: Fix use-after-free access in ucma_close()

    The error in ucma_create_id() left ctx in the list of contexts belong
    to ucma file descriptor. The attempt to close this file descriptor causes
    to use-after-free accesses while iterating over such list.

    Linux commit:
    ed65a4dc22083e73bac599ded6a262318cad7baf

    PR:             264650
    Sponsored by:   NVIDIA Networking

    (cherry picked from commit 66a0bc2105e43e54abfaa9f48b76c28371fa2d62)

 sys/ofed/drivers/infiniband/core/ib_ucma.c | 3 +++
 1 file changed, 3 insertions(+)