tree 01c6de89a3d60c35d2133c0b6b1903509a8f1df8
parent 1c9cf6f9861f8d27303ee2531b3b7686269c71ce
author Roland Dreier <[EMAIL PROTECTED]> Sat, 27 Aug 2005 08:34:14 -0700
committer Linus Torvalds <[EMAIL PROTECTED]> Sat, 27 Aug 2005 09:37:12 -0700

[PATCH] IB: fix use-after-free in user verbs cleanup

Fix a use-after-free bug in userspace verbs cleanup: we can't touch
mr->device after we free mr by calling ib_dereg_mr().

Signed-off-by: Roland Dreier <[EMAIL PROTECTED]>
Signed-off-by: Andrew Morton <[EMAIL PROTECTED]>
Signed-off-by: Linus Torvalds <[EMAIL PROTECTED]>

 drivers/infiniband/core/uverbs_main.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/infiniband/core/uverbs_main.c 
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -130,13 +130,14 @@ static int ib_dealloc_ucontext(struct ib
        list_for_each_entry_safe(uobj, tmp, &context->mr_list, list) {
                struct ib_mr *mr = idr_find(&ib_uverbs_mr_idr, uobj->id);
+               struct ib_device *mrdev = mr->device;
                struct ib_umem_object *memobj;
                idr_remove(&ib_uverbs_mr_idr, uobj->id);
                memobj = container_of(uobj, struct ib_umem_object, uobject);
-               ib_umem_release_on_close(mr->device, &memobj->umem);
+               ib_umem_release_on_close(mrdev, &memobj->umem);
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at

Reply via email to