diff options
| author | Selvin Xavier <selvin.xavier@broadcom.com> | 2023-08-10 06:44:35 +0200 |
|---|---|---|
| committer | Jason Gunthorpe <jgg@nvidia.com> | 2023-08-10 21:35:54 +0200 |
| commit | 5363fc488da579923edf6a2fdca3d3b651dd800b (patch) | |
| tree | 3becd778ec5b48fe6841b246d26a49a6e3940342 /drivers | |
| parent | MAINTAINERS: Remove maintainer of HiSilicon RoCE (diff) | |
| download | linux-5363fc488da579923edf6a2fdca3d3b651dd800b.tar.xz linux-5363fc488da579923edf6a2fdca3d3b651dd800b.zip | |
RDMA/bnxt_re: Properly order ib_device_unalloc() to avoid UAF
ib_dealloc_device() should be called only after device cleanup. Fix the
dealloc sequence.
Fixes: 6d758147c7b8 ("RDMA/bnxt_re: Use auxiliary driver interface")
Link: https://lore.kernel.org/r/1691642677-21369-2-git-send-email-selvin.xavier@broadcom.com
Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/infiniband/hw/bnxt_re/main.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/infiniband/hw/bnxt_re/main.c b/drivers/infiniband/hw/bnxt_re/main.c index b42166fe7454..1c7646057893 100644 --- a/drivers/infiniband/hw/bnxt_re/main.c +++ b/drivers/infiniband/hw/bnxt_re/main.c @@ -1526,8 +1526,8 @@ static void bnxt_re_remove(struct auxiliary_device *adev) } bnxt_re_setup_cc(rdev, false); ib_unregister_device(&rdev->ibdev); - ib_dealloc_device(&rdev->ibdev); bnxt_re_dev_uninit(rdev); + ib_dealloc_device(&rdev->ibdev); skip_remove: mutex_unlock(&bnxt_re_mutex); } |