RDMA/ocrdma: Fix use after free in ocrdma_dealloc_ucontext_pd()
commit5.4-rM2-2.2.x-imx-squashedf2bc3af635
upstream. In ocrdma_dealloc_ucontext_pd() uctx->cntxt_pd is assigned to the variable pd and then after uctx->cntxt_pd is freed, the variable pd is passed to function _ocrdma_dealloc_pd() which dereferences pd directly or through its call to ocrdma_mbx_dealloc_pd(). Reorder the free using the variable pd. Cc: stable@vger.kernel.org Fixes:21a428a019
("RDMA: Handle PD allocations by IB/core") Link: https://lore.kernel.org/r/20201230024653.1516495-1-trix@redhat.com Signed-off-by: Tom Rix <trix@redhat.com> Reviewed-by: Leon Romanovsky <leonro@nvidia.com> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
parent
f7a97dc302
commit
bc0b70f1d2
|
@ -442,9 +442,9 @@ static void ocrdma_dealloc_ucontext_pd(struct ocrdma_ucontext *uctx)
|
|||
pr_err("%s(%d) Freeing in use pdid=0x%x.\n",
|
||||
__func__, dev->id, pd->id);
|
||||
}
|
||||
kfree(uctx->cntxt_pd);
|
||||
uctx->cntxt_pd = NULL;
|
||||
_ocrdma_dealloc_pd(dev, pd);
|
||||
kfree(pd);
|
||||
}
|
||||
|
||||
static struct ocrdma_pd *ocrdma_get_ucontext_pd(struct ocrdma_ucontext *uctx)
|
||||
|
|
Loading…
Reference in New Issue