From: wenglianfa wenglianfa@huawei.com
driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9QO9C
----------------------------------------------------------------------
After sysfs is disabled, scc delay_work may continue to be executed, causing the UAF problem. To fix it, cancel_delayde_work_sync () is introduced to ensure that scc delay_work is canceled or executed.
Fixes: 523f34d81ea7 ("RDMA/hns: Support congestion control algorithm parameter configuration") Signed-off-by: wenglianfa wenglianfa@huawei.com --- drivers/infiniband/hw/hns/hns_roce_sysfs.c | 5 +++++ 1 file changed, 5 insertions(+)
diff --git a/drivers/infiniband/hw/hns/hns_roce_sysfs.c b/drivers/infiniband/hw/hns/hns_roce_sysfs.c index b6a9369d8147..a51423b94dc1 100644 --- a/drivers/infiniband/hw/hns/hns_roce_sysfs.c +++ b/drivers/infiniband/hw/hns/hns_roce_sysfs.c @@ -429,10 +429,15 @@ int hns_roce_create_port_files(struct ib_device *ibdev, u8 port_num, static void hns_roce_unregister_port_sysfs(struct hns_roce_dev *hr_dev, u8 port_num) { + struct hns_roce_scc_param *scc_param; struct hns_roce_port *pdata; + int i;
pdata = &hr_dev->port_data[port_num]; sysfs_remove_groups(&pdata->kobj, hns_attr_port_groups); + scc_param = pdata->scc_param; + for (i = 0; i < HNS_ROCE_SCC_ALGO_TOTAL; i++) + cancel_delayed_work_sync(&scc_param[i].scc_cfg_dwork); kobject_put(&pdata->kobj); }