diff options
| author | Bart Van Assche <bvanassche@acm.org> | 2014-06-06 18:25:04 +0200 |
|---|---|---|
| committer | Roland Dreier <roland@purestorage.com> | 2014-06-06 20:38:31 +0200 |
| commit | 60e1751cb52cc6d1ae04b6bd3c2b96e770b5823f (patch) | |
| tree | ae59c751a309e88520647cc2580f1be10adbc98e /drivers/infiniband/hw/mlx4/qp.c | |
| parent | IB/core: Fix kobject leak on device register error flow (diff) | |
| download | linux-60e1751cb52cc6d1ae04b6bd3c2b96e770b5823f.tar.xz linux-60e1751cb52cc6d1ae04b6bd3c2b96e770b5823f.zip | |
IB/umad: Fix use-after-free on close
Avoid that closing /dev/infiniband/umad<n> or /dev/infiniband/issm<n>
triggers a use-after-free. __fput() invokes f_op->release() before it
invokes cdev_put(). Make sure that the ib_umad_device structure is
freed by the cdev_put() call instead of f_op->release(). This avoids
that changing the port mode from IB into Ethernet and back to IB
followed by restarting opensmd triggers the following kernel oops:
general protection fault: 0000 [#1] PREEMPT SMP
RIP: 0010:[<ffffffff810cc65c>] [<ffffffff810cc65c>] module_put+0x2c/0x170
Call Trace:
[<ffffffff81190f20>] cdev_put+0x20/0x30
[<ffffffff8118e2ce>] __fput+0x1ae/0x1f0
[<ffffffff8118e35e>] ____fput+0xe/0x10
[<ffffffff810723bc>] task_work_run+0xac/0xe0
[<ffffffff81002a9f>] do_notify_resume+0x9f/0xc0
[<ffffffff814b8398>] int_signal+0x12/0x17
Reference: https://bugzilla.kernel.org/show_bug.cgi?id=75051
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Reviewed-by: Yann Droneaud <ydroneaud@opteya.com>
Cc: <stable@vger.kernel.org> # 3.x: 8ec0a0e6b58: IB/umad: Fix error handling
Signed-off-by: Roland Dreier <roland@purestorage.com>
Diffstat (limited to 'drivers/infiniband/hw/mlx4/qp.c')
0 files changed, 0 insertions, 0 deletions