Tom Rix bc0b70f1d2 RDMA/ocrdma: Fix use after free in ocrdma_dealloc_ucontext_pd() ... commit f2bc3af635 upstream. In ocrdma_dealloc_ucontext_pd() uctx->cntxt_pd is assigned to the variable pd and then after uctx->cntxt_pd is freed, the variable pd is passed to function _ocrdma_dealloc_pd() which dereferences pd directly or through its call to ocrdma_mbx_dealloc_pd(). Reorder the free using the variable pd. Cc: stable@vger.kernel.org Fixes: 21a428a019 ("RDMA: Handle PD allocations by IB/core") Link: https://lore.kernel.org/r/20201230024653.1516495-1-trix@redhat.com Signed-off-by: Tom Rix <trix@redhat.com> Reviewed-by: Leon Romanovsky <leonro@nvidia.com> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2021-01-19 18:26:12 +01:00
..
core	RDMA/cma: Don't overwrite sgid_attr after device is released	2020-12-30 11:51:26 +01:00
hw	RDMA/ocrdma: Fix use after free in ocrdma_dealloc_ucontext_pd()	2021-01-19 18:26:12 +01:00
sw	RDMA/rxe: Compute PSN windows correctly	2020-12-30 11:51:02 +01:00
ulp	RDMA/ipoib: Set rtnl_link_ops for ipoib interfaces	2020-10-29 09:57:51 +01:00
Kconfig	RMDA/sw: Don't allow drivers using dma_virt_ops on highmem configs	2020-11-24 13:29:05 +01:00
Makefile	treewide: Add SPDX license identifier - Makefile/Kconfig	2019-05-21 10:50:46 +02:00