Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit dabcbe58 authored by Daniel Jurgens's avatar Daniel Jurgens Committed by Greg Kroah-Hartman
Browse files

IB/core: Unregister notifier before freeing MAD security 



commit d60667fc398ed34b3c7456b020481c55c760e503 upstream.

If the notifier runs after the security context is freed an access of
freed memory can occur.

Fixes: 47a2b338 ("IB/core: Enforce security on management datagrams")
Signed-off-by: default avatarDaniel Jurgens <danielj@mellanox.com>
Reviewed-by: default avatarParav Pandit <parav@mellanox.com>
Signed-off-by: default avatarLeon Romanovsky <leonro@mellanox.com>
Signed-off-by: default avatarJason Gunthorpe <jgg@mellanox.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent d1698f74

drivers/infiniband/core/security.c

+2 −1
Original line number Diff line number Diff line
@@ -728,9 +728,10 @@ void ib_mad_agent_security_cleanup(struct ib_mad_agent *agent) 
	if (!rdma_protocol_ib(agent->device, agent->port_num))

		return;



	security_ib_free_security(agent->security);

	if (agent->lsm_nb_reg)

		unregister_lsm_notifier(&agent->lsm_nb);



	security_ib_free_security(agent->security);

}



int ib_mad_enforce_security(struct ib_mad_agent_private *map, u16 pkey_index)