IB/isert: Fix a use after free in isert_connect_request
authorLv Yunlong <lyl2019@mail.ustc.edu.cn>
Mon, 22 Mar 2021 16:13:25 +0000 (09:13 -0700)
committerJason Gunthorpe <jgg@nvidia.com>
Fri, 26 Mar 2021 17:15:40 +0000 (14:15 -0300)
commitadb76a520d068a54ee5ca82e756cf8e5a47363a4
treed555b618fc0fb2792dcb144ff088bc227b852d53
parentaa43665aeeb3db66ad732d168b5d6450eb4c60db
IB/isert: Fix a use after free in isert_connect_request

The device is got by isert_device_get() with refcount is 1, and is
assigned to isert_conn by
  isert_conn->device = device.

When isert_create_qp() failed, device will be freed with
isert_device_put().

Later, the device is used in isert_free_login_buf(isert_conn) by the
isert_conn->device->ib_device statement.

Free the device in the correct order.

Fixes: ae9ea9ed38c9 ("iser-target: Split some logic in isert_connect_request to routines")
Link: https://lore.kernel.org/r/20210322161325.7491-1-lyl2019@mail.ustc.edu.cn
Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
Acked-by: Sagi Grimberg <sagi@grimberg.me>
Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
Reviewed-by: Max Gurtovoy <mgurtovoy@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
drivers/infiniband/ulp/isert/ib_isert.c