IB/isert: Fix a use after free in isert_connect_request

The device is got by isert_device_get() with refcount is 1, and is
assigned to isert_conn by
  isert_conn->device = device.

When isert_create_qp() failed, device will be freed with
isert_device_put().

Later, the device is used in isert_free_login_buf(isert_conn) by the
isert_conn->device->ib_device statement.

Free the device in the correct order.

Fixes: ae9ea9ed38c9 ("iser-target: Split some logic in isert_connect_request to routines")
Link: https://lore.kernel.org/r/20210322161325.7491-1-lyl2019@mail.ustc.edu.cn
Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
Acked-by: Sagi Grimberg <sagi@grimberg.me>
Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
Reviewed-by: Max Gurtovoy <mgurtovoy@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>

diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
index 7305ed8976c2452c4a36be35d69f46bdbf089a57..18266f07c58d9c94caf05ea27401b6d19d970e9a 100644 (file)
--- a/drivers/infiniband/ulp/isert/ib_isert.c
+++ b/drivers/infiniband/ulp/isert/ib_isert.c
@@ -438,23 +438,23 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
        isert_init_conn(isert_conn);
        isert_conn->cm_id = cma_id;
 
-       ret = isert_alloc_login_buf(isert_conn, cma_id->device);
-       if (ret)
-               goto out;
-
        device = isert_device_get(cma_id);
        if (IS_ERR(device)) {
                ret = PTR_ERR(device);
-               goto out_rsp_dma_map;
+               goto out;
        }
        isert_conn->device = device;
 
+       ret = isert_alloc_login_buf(isert_conn, cma_id->device);
+       if (ret)
+               goto out_conn_dev;
+
        isert_set_nego_params(isert_conn, &event->param.conn);
 
        isert_conn->qp = isert_create_qp(isert_conn, cma_id);
        if (IS_ERR(isert_conn->qp)) {
                ret = PTR_ERR(isert_conn->qp);
-               goto out_conn_dev;
+               goto out_rsp_dma_map;
        }
 
        ret = isert_login_post_recv(isert_conn);
@@ -473,10 +473,10 @@ isert_connect_request(struct rdma_cm_id *cma_id, struct rdma_cm_event *event)
 
 out_destroy_qp:
        isert_destroy_qp(isert_conn);
-out_conn_dev:
-       isert_device_put(device);
 out_rsp_dma_map:
        isert_free_login_buf(isert_conn);
+out_conn_dev:
+       isert_device_put(device);
 out:
        kfree(isert_conn);
        rdma_reject(cma_id, NULL, 0, IB_CM_REJ_CONSUMER_DEFINED);