ibcore: Fix use-after-free access in ucma_close()
The error in ucma_create_id() left ctx in the list of contexts belong to ucma file descriptor. The attempt to close this file descriptor causes to use-after-free accesses while iterating over such list. Linux commit: ed65a4dc22083e73bac599ded6a262318cad7baf PR: 264650 MFC after: 1 week Sponsored by: NVIDIA Networking
This commit is contained in:
parent
e4d178d093
commit
66a0bc2105
@ -508,6 +508,9 @@ static ssize_t ucma_create_id(struct ucma_file *file, const char __user *inbuf,
|
|||||||
mutex_lock(&mut);
|
mutex_lock(&mut);
|
||||||
idr_remove(&ctx_idr, ctx->id);
|
idr_remove(&ctx_idr, ctx->id);
|
||||||
mutex_unlock(&mut);
|
mutex_unlock(&mut);
|
||||||
|
mutex_lock(&file->mut);
|
||||||
|
list_del(&ctx->list);
|
||||||
|
mutex_unlock(&file->mut);
|
||||||
kfree(ctx);
|
kfree(ctx);
|
||||||
return ret;
|
return ret;
|
||||||
}
|
}
|
||||||
|
Loading…
Reference in New Issue
Block a user