Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit bc0b70f1 authored by Tom Rix's avatar Tom Rix Committed by Greg Kroah-Hartman
Browse files

RDMA/ocrdma: Fix use after free in ocrdma_dealloc_ucontext_pd() 

commit f2bc3af6353cb2a33dfa9d270d999d839eef54cb upstream.

In ocrdma_dealloc_ucontext_pd() uctx->cntxt_pd is assigned to the variable
pd and then after uctx->cntxt_pd is freed, the variable pd is passed to
function _ocrdma_dealloc_pd() which dereferences pd directly or through
its call to ocrdma_mbx_dealloc_pd().

Reorder the free using the variable pd.

Cc: stable@vger.kernel.org
Fixes: 21a428a0 ("RDMA: Handle PD allocations by IB/core")
Link: https://lore.kernel.org/r/20201230024653.1516495-1-trix@redhat.com


Signed-off-by: default avatarTom Rix <trix@redhat.com>
Reviewed-by: default avatarLeon Romanovsky <leonro@nvidia.com>
Signed-off-by: default avatarJason Gunthorpe <jgg@nvidia.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent f7a97dc3

drivers/infiniband/hw/ocrdma/ocrdma_verbs.c

+1 −1
Original line number Diff line number Diff line
@@ -442,9 +442,9 @@ static void ocrdma_dealloc_ucontext_pd(struct ocrdma_ucontext *uctx) 
		pr_err("%s(%d) Freeing in use pdid=0x%x.\n",

		       __func__, dev->id, pd->id);

	}

	kfree(uctx->cntxt_pd);

	uctx->cntxt_pd = NULL;

	_ocrdma_dealloc_pd(dev, pd);

	kfree(pd);

}



static struct ocrdma_pd *ocrdma_get_ucontext_pd(struct ocrdma_ucontext *uctx)