lkml.org 
[lkml]   [2005]   [Aug]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Subject[PATCH] IB: fix use-after-free in user verbs cleanup
From
Date
Hi Andrew,

I'd like to get this into 2.6.13 if possible. If it's too late, it's
not the end of the world -- we can wait for 2.6.13.1. But it's a
tiny, obvious patch that fixes a crash that at least one person
actually hit running a normal application:
http://openib.org/pipermail/openib-general/2005-August/010248.html

Thanks,
Roland


Fix a use-after-free bug in userspace verbs cleanup: we can't touch
mr->device after we free mr by calling ib_dereg_mr().

diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -130,13 +130,14 @@ static int ib_dealloc_ucontext(struct ib

list_for_each_entry_safe(uobj, tmp, &context->mr_list, list) {
struct ib_mr *mr = idr_find(&ib_uverbs_mr_idr, uobj->id);
+ struct ib_device *mrdev = mr->device;
struct ib_umem_object *memobj;

idr_remove(&ib_uverbs_mr_idr, uobj->id);
ib_dereg_mr(mr);

memobj = container_of(uobj, struct ib_umem_object, uobject);
- ib_umem_release_on_close(mr->device, &memobj->umem);
+ ib_umem_release_on_close(mrdev, &memobj->umem);

list_del(&uobj->list);
kfree(memobj);
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
\
 
 \ /
  Last update: 2005-08-26 03:07    [W:0.039 / U:0.796 seconds]
©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site