Messages in this thread | | | From | Selvin Xavier <> | Date | Mon, 11 Jan 2021 23:39:34 +0530 | Subject | Re: [PATCH] RDMA/ocrdma: fix use after free in ocrdma_dealloc_ucontext_pd() |
| |
On Fri, Jan 8, 2021 at 3:13 AM Tom Rix <trix@redhat.com> wrote: > > > On 1/7/21 12:41 PM, Jason Gunthorpe wrote: > > On Tue, Dec 29, 2020 at 06:46:53PM -0800, trix@redhat.com wrote: > >> From: Tom Rix <trix@redhat.com> > >> > >> In ocrdma_dealloc_ucontext_pd() uctx->cntxt_pd is assigned to > >> the variable pd and then after uctx->cntxt_pd is freed, the > >> variable pd is passed to function _ocrdma_dealloc_pd() which > >> dereferences pd directly or through its call to > >> ocrdma_mbx_dealloc_pd(). > >> > >> Reorder the free using the variable pd. > >> > >> Fixes: 21a428a019c9 ("RDMA: Handle PD allocations by IB/core") > >> Signed-off-by: Tom Rix <trix@redhat.com> > >> drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 2 +- > >> 1 file changed, 1 insertion(+), 1 deletion(-) > > Applied to for-rc > > > > Is anyone testing ocrdma? Just doing the pyverbs rdma tests with kasn > > turned on would have instantly caught this, and the change is nearly a > > year old. > > > > Is ocrdma obsolete enough we can delete the driver?
Broadcom is not doing any active development/testing with ocrdma now. I am checking with other teams to see if this can be deleted completely. Will get back asap.
Thanks, Selvin
> > I am not an authority on ocrdma, i am fixing treewide, the problems clang static analysis flags. > > Tom > > > > > Thanks, > > Jason > > > [unhandled content-type:application/pkcs7-signature] | |