IB: fix use-after-free in user verbs cleanup
PATCH 1/1 IB: fix use-after-free in user verbs cleanup
Hi Andrew,
I'd like to get this into 2.6.13 if possible. If it's too late, it's not the end of the world -- we can wait for 2.6.13.1. But it's a tiny, obvious patch that fixes a crash that at least one person actually hit running a normal application:
http://openib.org/pipermail/openib-general/2005-August/010248.html
Thanks,
Roland
Fix a use-after-free bug in userspace verbs cleanup: we can't touch mr->device after we free mr by calling ib_dereg_mr().
drivers/infiniband/core/uverbs_main.c +2 -1
@@ -130,13 +130,14 @@ static int ib_dealloc_ucontext(struct iblist_for_each_entry_safe (uobj, tmp, &context->mr_list, list) {struct ib_mr *mr =idr_find (&ib_uverbs_mr_idr, uobj->id); +struct ib_device *mrdev = mr->device;struct ib_umem_object *memobj;idr_remove (&ib_uverbs_mr_idr, uobj->id);ib_dereg_mr (mr); memobj = container_of(uobj, struct ib_umem_object, uobject); -ib_umem_release_on_close (mr->device, &memobj->umem); +ib_umem_release_on_close (mrdev, &memobj->umem);list_del (&uobj->list);kfree (memobj);