d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

ibcore: Fix use-after-free access in ucma_close()

Browse Source 
The error in ucma_create_id() left ctx in the list of contexts belong
to ucma file descriptor. The attempt to close this file descriptor causes
to use-after-free accesses while iterating over such list.

Linux commit:
ed65a4dc22083e73bac599ded6a262318cad7baf

PR:		264650
MFC after:	1 week
Sponsored by:	NVIDIA Networking
This commit is contained in:
Hans Petter Selasky 2022-06-13 16:55:14 +02:00
parent e4d178d093
commit 66a0bc2105
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
sys/ofed/drivers/infiniband/core/ib_ucma.c
View File

@ -508,6 +508,9 @@ static ssize_t ucma_create_id(struct ucma_file *file, const char __user *inbuf,
mutex_lock(&mut);
idr_remove(&ctx_idr, ctx->id);
mutex_unlock(&mut);
mutex_lock(&file->mut);
list_del(&ctx->list);
mutex_unlock(&file->mut);
kfree(ctx);
return ret;
}