linux-stable

mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2025-01-10 07:00:48 +00:00

History

Tom Rix f2bc3af635 RDMA/ocrdma: Fix use after free in ocrdma_dealloc_ucontext_pd()

In ocrdma_dealloc_ucontext_pd() uctx->cntxt_pd is assigned to the variable
pd and then after uctx->cntxt_pd is freed, the variable pd is passed to
function _ocrdma_dealloc_pd() which dereferences pd directly or through
its call to ocrdma_mbx_dealloc_pd().

Reorder the free using the variable pd.

Cc: stable@vger.kernel.org
Fixes: 21a428a019c9 ("RDMA: Handle PD allocations by IB/core")
Link: https://lore.kernel.org/r/20201230024653.1516495-1-trix@redhat.com
Signed-off-by: Tom Rix <trix@redhat.com>
Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>

2021-01-07 16:37:11 -04:00

Kconfig

treewide: replace '---help---' in Kconfig files with 'help'

2020-06-14 01:57:21 +09:00

Makefile

treewide: Add SPDX license identifier - Makefile/Kconfig

2019-05-21 10:50:46 +02:00

ocrdma_ah.c

RDMA: Restore ability to fail on AH destroy

2020-09-09 13:57:22 -03:00

ocrdma_ah.h

RDMA: Restore ability to fail on AH destroy