title: RDMA/siw: Fix a use after free in siw_alloc_mr
description: In the Linux kernel, the following vulnerability has been resolved:
RDMA/siw: Fix a use after free in siw_alloc_mr
Our code analyzer reported a UAF.
In siw_alloc_mr(), it calls siw_mr_add_mem(mr,..). In the implementation of
siw_mr_add_mem(), mem is assigned to mr->mem and then mem is freed via
kfree(mem) if xa_alloc_cyclic() failed. Here, mr->mem still point to a
freed object. After, the execution continue up to the err_out branch of
siw_alloc_mr, and the freed mr->mem is used in siw_mr_drop_mem(mr).
My patch moves "mr->mem = mem" behind the if (xa_alloc_cyclic(..)<0) {}
section, to avoid the uaf.
affected:
{
product: Linux
vendor: Linux
defaultStatus: unaffected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions:
version: 2251334dcac9, lessThan: 30b9e92d0b5e, status: affected, versionType: git
version: 2251334dcac9, lessThan: 608a4b90ece0, status: affected, versionType: git
version: 2251334dcac9, lessThan: 3e22b88e02c1, status: affected, versionType: git
version: 2251334dcac9, lessThan: ad9ce7188432, status: affected, versionType: git
version: 2251334dcac9, lessThan: 3093ee182f01, status: affected, versionType: git
}
{
product: Linux
vendor: Linux
defaultStatus: affected
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
versions:
version: 5.3, status: affected
version: 0, lessThan: 5.3, status: unaffected, versionType: custom
version: 5.4.119, lessThanOrEqual: 5.4.*, status: unaffected, versionType: custom
version: 5.10.37, lessThanOrEqual: 5.10.*, status: unaffected, versionType: custom
version: 5.11.21, lessThanOrEqual: 5.11.*, status: unaffected, versionType: custom
version: 5.12.4, lessThanOrEqual: 5.12.*, status: unaffected, versionType: custom
version: 5.13, lessThanOrEqual: *, status: unaffected, versionType: original_commit_for_fix
}
