[PATCH] IB: fix use-after-free in user verbs cleanup

Fix a use-after-free bug in userspace verbs cleanup: we can't touch mr->device after we free mr by calling ib_dereg_mr().

Roland Dreier committed 21 years ago

Commit e1bcfca1 parent 1c9cf6f1 file · +2 −1Browse files

Unified · Split

@@ -130,13 +130,14 @@ static int ib_dealloc_ucontext(struct ib_ucontext *context) · 129 unmodified lines
130	130
131	131	list_for_each_entry_safe(uobj, tmp, &context->mr_list, list) {
132	132	struct ib_mr *mr = idr_find(&ib_uverbs_mr_idr, uobj->id);
	133	+ struct ib_device *mrdev = mr->device;
133	134	struct ib_umem_object *memobj;
134	135
135	136	idr_remove(&ib_uverbs_mr_idr, uobj->id);
136	137	ib_dereg_mr(mr);
137	138
138	139	memobj = container_of(uobj, struct ib_umem_object, uobject);
139		− ib_umem_release_on_close(mr->device, &memobj->umem);
	140	+ ib_umem_release_on_close(mrdev, &memobj->umem);
140	141
141	142	list_del(&uobj->list);
142	143	kfree(memobj);