The patch titled
IB: fix use-after-free in user verbs cleanup
has been added to the -mm tree. Its filename is
ib-fix-use-after-free-in-user-verbs-cleanup.patch
Patches currently in -mm which might be from [EMAIL PROTECTED] are
ib-fix-use-after-free-in-user-verbs-cleanup.patch
ppc32-dont-sleep-in-flush_dcache_icache_page.patch
From: Roland Dreier <[EMAIL PROTECTED]>
Fix a use-after-free bug in userspace verbs cleanup: we can't touch
mr->device after we free mr by calling ib_dereg_mr().
Signed-off-by: Roland Dreier <[EMAIL PROTECTED]>
Signed-off-by: Andrew Morton <[EMAIL PROTECTED]>
---
drivers/infiniband/core/uverbs_main.c | 3 ++-
1 files changed, 2 insertions(+), 1 deletion(-)
diff -puN
drivers/infiniband/core/uverbs_main.c~ib-fix-use-after-free-in-user-verbs-cleanup
drivers/infiniband/core/uverbs_main.c
---
devel/drivers/infiniband/core/uverbs_main.c~ib-fix-use-after-free-in-user-verbs-cleanup
2005-08-26 12:53:48.000000000 -0700
+++ devel-akpm/drivers/infiniband/core/uverbs_main.c 2005-08-26
12:53:48.000000000 -0700
@@ -130,13 +130,14 @@ static int ib_dealloc_ucontext(struct ib
list_for_each_entry_safe(uobj, tmp, &context->mr_list, list) {
struct ib_mr *mr = idr_find(&ib_uverbs_mr_idr, uobj->id);
+ struct ib_device *mrdev = mr->device;
struct ib_umem_object *memobj;
idr_remove(&ib_uverbs_mr_idr, uobj->id);
ib_dereg_mr(mr);
memobj = container_of(uobj, struct ib_umem_object, uobject);
- ib_umem_release_on_close(mr->device, &memobj->umem);
+ ib_umem_release_on_close(mrdev, &memobj->umem);
list_del(&uobj->list);
kfree(memobj);
_
-
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at http://vger.kernel.org/majordomo-info.html
