[PATCH] IB: fix use-after-free in user verbs cleanup

e1bcfcaa · Roland Dreier <[email protected]> · 2005-08-26 18:34:14 -07:00

Fix a use-after-free bug in userspace verbs cleanup: we can't touch
mr->device after we free mr by calling ib_dereg_mr().

Signed-off-by: Roland Dreier <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>

Commit: e1bcfcaa0b3bec2a67b22c565a0bf508ea90db1d
Parents: 1c9cf6f9

Changes

1 files changed · +2 −1

File	Status	Add	Del	Content
drivers/infiniband/core/uverbs_main.c	modified	+2	−1	View file

drivers/infiniband/core/uverbs_main.c

View file

diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index eb99e69..5f6e9ea 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -130,13 +130,14 @@ static int ib_dealloc_ucontext(struct ib_ucontext *context)
 
 	list_for_each_entry_safe(uobj, tmp, &context->mr_list, list) {
 		struct ib_mr *mr = idr_find(&ib_uverbs_mr_idr, uobj->id);
+		struct ib_device *mrdev = mr->device;
 		struct ib_umem_object *memobj;
 
 		idr_remove(&ib_uverbs_mr_idr, uobj->id);
 		ib_dereg_mr(mr);
 
 		memobj = container_of(uobj, struct ib_umem_object, uobject);
-		ib_umem_release_on_close(mr->device, &memobj->umem);
+		ib_umem_release_on_close(mrdev, &memobj->umem);
 
 		list_del(&uobj->list);
 		kfree(memobj);