linux/drivers/infiniband/hw
Tom Rix f2bc3af635 RDMA/ocrdma: Fix use after free in ocrdma_dealloc_ucontext_pd()
In ocrdma_dealloc_ucontext_pd() uctx->cntxt_pd is assigned to the variable
pd and then after uctx->cntxt_pd is freed, the variable pd is passed to
function _ocrdma_dealloc_pd() which dereferences pd directly or through
its call to ocrdma_mbx_dealloc_pd().

Reorder the free using the variable pd.

Cc: stable@vger.kernel.org
Fixes: 21a428a019 ("RDMA: Handle PD allocations by IB/core")
Link: https://lore.kernel.org/r/20201230024653.1516495-1-trix@redhat.com
Signed-off-by: Tom Rix <trix@redhat.com>
Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
2021-01-07 16:37:11 -04:00
..
bnxt_re RDMA/bnxt_re: Fix max_qp_wrs reported 2020-12-07 15:43:42 -04:00
cxgb4 RDMA/cxgb4: Validate the number of CQEs 2020-11-23 16:19:46 -04:00
efa RDMA 5.11 pull request 2020-12-16 13:42:26 -08:00
hfi1 RDMA 5.11 pull request 2020-12-16 13:42:26 -08:00
hns RDMA/hns: Simplify AEQE process for different types of queue 2020-12-11 15:21:35 -04:00
i40iw RDMA/i40iw: Replace atomic_add_return(1, ..) 2020-12-07 15:40:23 -04:00
mlx4 RDMA/mlx4: Remove bogus dev_base_lock usage 2020-12-10 16:58:25 -04:00
mlx5 RDMA 5.11 pull request 2020-12-16 13:42:26 -08:00
mthca Linux 5.10-rc6 2020-12-01 20:40:50 -04:00
ocrdma RDMA/ocrdma: Fix use after free in ocrdma_dealloc_ucontext_pd() 2021-01-07 16:37:11 -04:00
qedr RDMA 5.11 pull request 2020-12-16 13:42:26 -08:00
qib IB/qib: Use dma_set_mask_and_coherent to simplify code 2020-11-23 16:37:20 -04:00
usnic RDMA/usnic: Fix memleak in find_free_vf_and_create_qp_grp 2021-01-07 16:07:12 -04:00
vmw_pvrdma Merge branch 'for-rc' into rdma.git 2020-11-17 15:20:26 -04:00
Makefile RDMA/iw_cxgb3: Remove the iw_cxgb3 module from kernel 2019-10-04 15:08:59 -03:00