Chengchang TangandGreg Kroah-Hartman 330c825e66 RDMA/hns: Fix UAF for cq async event ...

[ Upstream commit a942ec2745 ]

The refcount of CQ is not protected by locks. When CQ asynchronous
events and CQ destruction are concurrent, CQ may have been released,
which will cause UAF.

Use the xa_lock() to protect the CQ refcount.

Fixes: 9a4435375c ("IB/hns: Add driver files for hns RoCE driver")
Signed-off-by: Chengchang Tang <tangchengchang@huawei.com>
Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com>
Link: https://lore.kernel.org/r/20240412091616.370789-6-huangjunxian6@hisilicon.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Haixiao Yan <haixiao.yan.cn@windriver.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2024-10-17 15:11:58 +02:00

..

accessibility

…

acpi

ACPI: battery: Fix possible crash when unregistering a battery hook

2024-10-17 15:11:47 +02:00

amba

…

android

binder: fix UAF caused by offsets overwrite

2024-09-12 11:07:51 +02:00

ata

ata: sata_sil: Rename sil_blacklist to sil_quirks

2024-10-17 15:11:29 +02:00

atm

…

auxdisplay

…

base

driver core: bus: Return -EIO instead of 0 when show/store invalid bus attribute

2024-10-17 15:11:52 +02:00

bcma

…

block

aoe: fix the potential use-after-free problem in more places

2024-10-17 15:11:39 +02:00

bluetooth

Bluetooth: btmrvl: Use IRQF_NO_AUTOEN flag in request_irq()

2024-10-17 15:11:20 +02:00

bus

bus: integrator-lm: fix OF node leak in probe()

2024-10-17 15:11:12 +02:00

cdrom

…

char

virtio_console: fix misc probe bugs

2024-10-17 15:11:49 +02:00

clk

clk: imx: Remove CLK_SET_PARENT_GATE for DRAM mux for i.MX7D

2024-10-17 15:11:52 +02:00

clocksource

clocksource/drivers/qcom: Add missing iounmap() on errors in msm_dt_timer_init()

2024-10-17 15:10:49 +02:00

comedi

comedi: ni_routing: tools: Check when the file could not be opened

2024-10-17 15:11:52 +02:00

connector

…

counter

…

cpufreq

cpufreq: ti-cpufreq: Introduce quirks to handle syscon fails appropriately

2024-10-17 15:10:45 +02:00

cpuidle

…

crypto

crypto: ccp - Properly unregister /dev/sev on sev PLATFORM_STATUS failure

2024-10-17 15:11:13 +02:00

cxl

…

dax

…

dca

…

devfreq

…

dio

…

dma

…

dma-buf

dma-buf: heaps: Fix off-by-one in CMA heap fault handler

2024-10-17 15:10:37 +02:00

edac

EDAC/igen6: Fix conversion of system address to physical memory address

2024-10-17 15:11:16 +02:00

eisa

…

extcon

…

firewire

…

firmware

firmware: tegra: bpmp: Drop unused mbox_client_to_bpmp()

2024-10-17 15:11:35 +02:00

fpga

…

fsi

…

gnss

…

gpio

gpio: aspeed: Use devm_clk api to manage clock source

2024-10-17 15:11:55 +02:00

gpu

drm/amd/display: Check null pointer before dereferencing se

2024-10-17 15:11:53 +02:00

greybus

…

hid

HID: multitouch: Add support for Thinkpad X12 Gen 2 Kbd Portfolio

2024-10-17 15:11:31 +02:00

hsi

…

hv

Drivers: hv: vmbus: Fix rescind handling in uio_hv_generic

2024-09-12 11:07:51 +02:00

hwmon

hwmon: (ntc_thermistor) fix module autoloading

2024-10-17 15:10:50 +02:00

hwspinlock

hwspinlock: Introduce hwspin_lock_bust()

2024-09-12 11:07:41 +02:00

hwtracing

coresight: tmc: sg: Do not leak sg_table

2024-10-17 15:11:06 +02:00

i2c

i2c: i801: Use a different adapter-name for IDF adapters

2024-10-17 15:11:51 +02:00

i3c

i3c: mipi-i3c-hci: Error out instead on BUG_ON() in IBI DMA setup

2024-09-12 11:07:49 +02:00

idle

…

iio

iio: magnetometer: ak8975: Fix reading for ak099xx sensors

2024-10-17 15:11:40 +02:00

infiniband

RDMA/hns: Fix UAF for cq async event

2024-10-17 15:11:58 +02:00

input

Input: synaptics-rmi4 - fix UAF of IRQ domain on driver removal

2024-10-17 15:11:49 +02:00

interconnect

interconnect: qcom: sm8250: Enable sync_state

2024-10-17 15:11:06 +02:00

iommu

iommu/vt-d: Fix potential lockup if qi_submit_sync called with 0 count

2024-10-17 15:11:29 +02:00

ipack

…

irqchip

irqchip/armada-370-xp: Do not allow mapping IRQ 0 and 1

2024-09-12 11:07:45 +02:00

isdn

…

leds

leds: spi-byte: Call of_node_put() on error path

2024-09-12 11:07:46 +02:00

macintosh

…

mailbox

mailbox: bcm2835: Fix timeout during suspend mode

2024-10-17 15:11:19 +02:00

mcb

…

md

Revert "dm: requeue IO if mapping table not yet available"

2024-10-17 15:11:06 +02:00

media

media: videobuf2-core: clear memory related fields in __vb2_plane_dmabuf_put()

2024-10-17 15:11:51 +02:00

memory

…

memstick

…

message

…

mfd

…

misc

eeprom: digsy_mtc: Fix 93xx46 driver probe failure

2024-10-17 15:10:35 +02:00

mmc

mmc: cqhci: Fix checking of CQHCI_HALT state

2024-09-12 11:07:43 +02:00

most

…

mtd

mtd: powernv: Add check devm_kasprintf() returned value

2024-10-17 15:10:50 +02:00

mux

…

net

slip: make slhc_remember() more robust against malicious packets

2024-10-17 15:11:58 +02:00

nfc

…

ntb

ntb: ntb_hw_switchtec: Fix use after free vulnerability in switchtec_ntb_remove due to race condition

2024-10-17 15:11:51 +02:00

nubus

…

nvdimm

virtio_pmem: Check device status before requesting flush

2024-10-17 15:11:52 +02:00

nvme

nvme-pci: qdepth 1 quirk

2024-10-17 15:11:25 +02:00

nvmem

nvmem: Fix return type of devm_nvmem_device_get() in kerneldoc

2024-09-12 11:07:51 +02:00

of

of/irq: Refer to actual buffer size in of_irq_parse_one()

2024-10-17 15:11:32 +02:00

opp

…

parisc

…

parport

…

pci

PCI: Mark Creative Labs EMU20k2 INTx masking as broken

2024-10-17 15:11:51 +02:00

pcmcia

pcmcia: Use resource_size function on resource object

2024-09-12 11:07:46 +02:00

perf

…

phy

phy: zynqmp: Enable reference clock correctly

2024-09-04 13:23:42 +02:00

pinctrl

pinctrl: mvebu: Fix devinit_dove_pinctrl_probe function

2024-10-17 15:11:01 +02:00

platform

platform/x86: ISST: Fix the KASAN report slab-out-of-bounds bug

2024-10-17 15:11:34 +02:00

pnp

…

power

power: supply: hwmon: Fix missing temp1_max_alarm attribute

2024-10-17 15:11:35 +02:00

powercap

powercap: RAPL: fix invalid initialization for pl4_supported field

2024-10-17 15:11:09 +02:00

pps

pps: add an error check in parport_attach

2024-10-17 15:11:17 +02:00

ps3

…

ptp

…

pwm

…

rapidio

…

ras

…

regulator

…

remoteproc

remoteproc: imx_rproc: Use imx specific hook for find_loaded_rsc_table

2024-10-17 15:11:51 +02:00

reset

reset: k210: fix OF node leak in probe() error path

2024-10-17 15:10:49 +02:00

rpmsg

…

rtc

rtc: at91sam9: fix OF node leak in probe() error path

2024-10-17 15:11:41 +02:00

s390

…

sbus

…

scsi

scsi: aacraid: Rearrange order of struct aac_srb_unit

2024-10-17 15:11:32 +02:00

sh

…

siox

…

slimbus

…

soc

soc: versatile: realview: fix soc_dev leak during device remove

2024-10-17 15:11:16 +02:00

soundwire

soundwire: stream: Revert "soundwire: stream: fix programming slave ports for non-continous port maps"

2024-10-17 15:10:37 +02:00

spi

spi: bcm63xx: Fix missing pm_runtime_disable()

2024-10-17 15:11:44 +02:00

spmi

…

ssb

…

staging

minmax: reduce min/max macro expansion in atomisp driver

2024-10-17 15:10:34 +02:00

target

…

tc

…

tee

…

thermal

thermal: intel: int340x: processor: Fix warning during module unload

2024-10-17 15:11:54 +02:00

thunderbolt

…

tty

tty: rp2: Fix reset with non forgiving PCIe host bridges

2024-10-17 15:11:13 +02:00

uio

Drivers: hv: vmbus: Fix rescind handling in uio_hv_generic

2024-09-12 11:07:51 +02:00

usb

usb: dwc2: Adjust the timing of USB Driver Interrupt Registration in the Crashkernel Scenario

2024-10-17 15:11:52 +02:00

vdpa

…

vfio

vfio/pci: fix potential memory leak in vfio_intx_enable()

2024-10-17 15:11:09 +02:00

vhost

vhost/scsi: null-ptr-dereference in vhost_scsi_get_req()

2024-10-17 15:11:47 +02:00

video

fbdev: sisfb: Fix strbuf array overflow

2024-10-17 15:11:53 +02:00

virt

…

virtio

vdpa: Add eventfd for the vdpa callback

2024-10-17 15:11:06 +02:00

visorbus

…

vlynq

…

vme

…

w1

…

watchdog

watchdog: imx_sc_wdt: Don't disable WDT in suspend

2024-10-17 15:11:02 +02:00

xen

xen/swiotlb: add alignment check for dma buffers

2024-10-17 15:10:55 +02:00

zorro

…

Kconfig

…

Makefile

…