Fix NULL pointer dereference during device removal in ibcore.
As part of ib_uverbs_remove_one which might be triggered upon reset flow, we trigger IB_EVENT_DEVICE_FATAL event to userspace application. If device was removed after uverbs fd was opened but before ib_uverbs_get_context was called, the event file will be accessed before it was allocated, result in NULL pointer dereference: Linux commit: 870201f95fcbd19538aef630393fe9d583eff82e MFC after: 1 week Sponsored by: Mellanox Technologies
This commit is contained in:
parent
ed222171a9
commit
765bd83cca
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=336376
@ -1274,7 +1274,6 @@ static void ib_uverbs_free_hw_resources(struct ib_uverbs_device *uverbs_dev,
|
||||
kref_get(&file->ref);
|
||||
mutex_unlock(&uverbs_dev->lists_mutex);
|
||||
|
||||
ib_uverbs_event_handler(&file->event_handler, &event);
|
||||
|
||||
mutex_lock(&file->cleanup_mutex);
|
||||
ucontext = file->ucontext;
|
||||
@ -1291,6 +1290,7 @@ static void ib_uverbs_free_hw_resources(struct ib_uverbs_device *uverbs_dev,
|
||||
* for example due to freeing the resources
|
||||
* (e.g mmput).
|
||||
*/
|
||||
ib_uverbs_event_handler(&file->event_handler, &event);
|
||||
ib_dev->disassociate_ucontext(ucontext);
|
||||
ib_uverbs_cleanup_ucontext(file, ucontext);
|
||||
}
|
||||
|
Loading…
Reference in New Issue
Block a user