RDMA/hns: Fix UAF for cq async event
authorChengchang Tang <tangchengchang@huawei.com>
Fri, 12 Apr 2024 09:16:11 +0000 (17:16 +0800)
committerLeon Romanovsky <leon@kernel.org>
Tue, 16 Apr 2024 12:06:47 +0000 (15:06 +0300)
commita942ec2745ca864cd8512142100e4027dc306a42
treea836057d376476f345ab55df64b701c0df56d900
parentb46494b6f9c19f141114a57729e198698f40af37
RDMA/hns: Fix UAF for cq async event

The refcount of CQ is not protected by locks. When CQ asynchronous
events and CQ destruction are concurrent, CQ may have been released,
which will cause UAF.

Use the xa_lock() to protect the CQ refcount.

Fixes: 9a4435375cd1 ("IB/hns: Add driver files for hns RoCE driver")
Signed-off-by: Chengchang Tang <tangchengchang@huawei.com>
Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com>
Link: https://lore.kernel.org/r/20240412091616.370789-6-huangjunxian6@hisilicon.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
drivers/infiniband/hw/hns/hns_roce_cq.c