Tom Rix bc0b70f1d2 RDMA/ocrdma: Fix use after free in ocrdma_dealloc_ucontext_pd() ... commit f2bc3af635 upstream. In ocrdma_dealloc_ucontext_pd() uctx->cntxt_pd is assigned to the variable pd and then after uctx->cntxt_pd is freed, the variable pd is passed to function _ocrdma_dealloc_pd() which dereferences pd directly or through its call to ocrdma_mbx_dealloc_pd(). Reorder the free using the variable pd. Cc: stable@vger.kernel.org Fixes: 21a428a019 ("RDMA: Handle PD allocations by IB/core") Link: https://lore.kernel.org/r/20201230024653.1516495-1-trix@redhat.com Signed-off-by: Tom Rix <trix@redhat.com> Reviewed-by: Leon Romanovsky <leonro@nvidia.com> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2021-01-19 18:26:12 +01:00
..
Kconfig	treewide: Add SPDX license identifier - Makefile/Kconfig	2019-05-21 10:50:46 +02:00
Makefile	treewide: Add SPDX license identifier - Makefile/Kconfig	2019-05-21 10:50:46 +02:00
ocrdma.h	IB/core: Define 'ib' and 'roce' rdma_ah_attr types	2017-05-01 14:32:43 -04:00
ocrdma_ah.c	RDMA: Directly cast the sockaddr union to sockaddr	2019-05-13 22:16:38 -03:00
ocrdma_ah.h	RDMA: Handle AH allocations by IB/core	2019-04-08 13:05:25 -03:00
ocrdma_hw.c	IB: Remove unneeded memset	2019-07-03 14:26:49 -03:00
ocrdma_hw.h	RDMA: Clean destroy CQ in drivers do not return errors	2019-06-11 16:17:10 -04:00
ocrdma_main.c	RDMA: Convert CQ allocations to be under core responsibility	2019-06-11 16:39:49 -04:00
ocrdma_sli.h	RDMA: Adding ethertype ETH_P_IBOE	2017-01-10 14:05:11 -05:00
ocrdma_stats.c	Merge branch 'devx-async' into k.o/for-next	2019-01-29 13:49:31 -07:00
ocrdma_stats.h	RDMA/ocrdma: Initialize stats resources in the driver before ib device registration.	2016-02-05 15:14:27 -05:00
ocrdma_verbs.c	RDMA/ocrdma: Fix use after free in ocrdma_dealloc_ucontext_pd()	2021-01-19 18:26:12 +01:00
ocrdma_verbs.h	RDMA: Convert CQ allocations to be under core responsibility	2019-06-11 16:39:49 -04:00