aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/infiniband
diff options
context:
space:
mode:
authorRoland Dreier <rolandd@cisco.com>2005-08-26 21:34:14 -0400
committerLinus Torvalds <torvalds@g5.osdl.org>2005-08-26 22:37:12 -0400
commite1bcfcaa0b3bec2a67b22c565a0bf508ea90db1d (patch)
tree01c6de89a3d60c35d2133c0b6b1903509a8f1df8 /drivers/infiniband
parent1c9cf6f9861f8d27303ee2531b3b7686269c71ce (diff)
[PATCH] IB: fix use-after-free in user verbs cleanup
Fix a use-after-free bug in userspace verbs cleanup: we can't touch mr->device after we free mr by calling ib_dereg_mr(). Signed-off-by: Roland Dreier <rolandd@cisco.com> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Diffstat (limited to 'drivers/infiniband')
-rw-r--r--drivers/infiniband/core/uverbs_main.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index eb99e693dec2..5f6e9ea29cd7 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -130,13 +130,14 @@ static int ib_dealloc_ucontext(struct ib_ucontext *context)
130 130
131 list_for_each_entry_safe(uobj, tmp, &context->mr_list, list) { 131 list_for_each_entry_safe(uobj, tmp, &context->mr_list, list) {
132 struct ib_mr *mr = idr_find(&ib_uverbs_mr_idr, uobj->id); 132 struct ib_mr *mr = idr_find(&ib_uverbs_mr_idr, uobj->id);
133 struct ib_device *mrdev = mr->device;
133 struct ib_umem_object *memobj; 134 struct ib_umem_object *memobj;
134 135
135 idr_remove(&ib_uverbs_mr_idr, uobj->id); 136 idr_remove(&ib_uverbs_mr_idr, uobj->id);
136 ib_dereg_mr(mr); 137 ib_dereg_mr(mr);
137 138
138 memobj = container_of(uobj, struct ib_umem_object, uobject); 139 memobj = container_of(uobj, struct ib_umem_object, uobject);
139 ib_umem_release_on_close(mr->device, &memobj->umem); 140 ib_umem_release_on_close(mrdev, &memobj->umem);
140 141
141 list_del(&uobj->list); 142 list_del(&uobj->list);
142 kfree(memobj); 143 kfree(memobj);