History

[PATCH] IB: fix use-after-free in user verbs cleanup

Fix a use-after-free bug in userspace verbs cleanup: we can't touch mr->device after we free mr by calling ib_dereg_mr().

Roland Dreier committed 21 years ago

Commit e1bcfca1 parent 1c9cf6f1 file · +2 −1Browse files

Unified · Split

drivers/infiniband/core/uverbs_main.c+2−1
@@ -130,13 +130,14 @@ static int ib_dealloc_ucontext(struct ib_ucontext *context) · 129 unmodified lines
130 130
131 list_for_each_entry_safe(uobj, tmp, &context->mr_list, list) {131 list_for_each_entry_safe(uobj, tmp, &context->mr_list, list) {
132 struct ib_mr *mr = idr_find(&ib_uverbs_mr_idr, uobj->id);132 struct ib_mr *mr = idr_find(&ib_uverbs_mr_idr, uobj->id);
133 struct ib_device *mrdev = mr->device;
133 struct ib_umem_object *memobj;134 struct ib_umem_object *memobj;
134 135
135 idr_remove(&ib_uverbs_mr_idr, uobj->id);136 idr_remove(&ib_uverbs_mr_idr, uobj->id);
136 ib_dereg_mr(mr);137 ib_dereg_mr(mr);
137 138
138 memobj = container_of(uobj, struct ib_umem_object, uobject);139 memobj = container_of(uobj, struct ib_umem_object, uobject);
139 ib_umem_release_on_close(mr->device, &memobj->umem);140 ib_umem_release_on_close(mrdev, &memobj->umem);
140 141
141 list_del(&uobj->list);142 list_del(&uobj->list);
142 kfree(memobj);143 kfree(memobj);