diff options
author | Jason Gunthorpe <jgg@mellanox.com> | 2019-05-21 17:55:22 +0000 |
---|---|---|
committer | Jason Gunthorpe <jgg@mellanox.com> | 2019-05-27 14:35:26 -0300 |
commit | 6875cb175ca7e0c24aa4460ac2b3257fdf662832 (patch) | |
tree | 31a4c1aa8de14bd4aa0c4dacb0aa51feb4a8471d /drivers/infiniband/core/uverbs_std_types_mr.c | |
parent | 619122be3d40c835eb5fad9e326780909926495d (diff) | |
download | linux-stable-6875cb175ca7e0c24aa4460ac2b3257fdf662832.tar.gz linux-stable-6875cb175ca7e0c24aa4460ac2b3257fdf662832.tar.bz2 linux-stable-6875cb175ca7e0c24aa4460ac2b3257fdf662832.zip |
RDMA/core: Clear out the udata before error unwind
The core code should not pass a udata to the driver destroy function that
contains the input from the create command. Otherwise the driver will
attempt to interpret the create udata as destroy udata, and at least in
the case of EFA, will leak resources.
Zero this stuff out before invoking destroy.
Reported-by: Leon Romanovsky <leonro@mellanox.com>
Fixes: c4367a26357b ("IB: Pass uverbs_attr_bundle down ib_x destroy path")
Reviewed-by: Gal Pressman <galpress@amazon.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Diffstat (limited to 'drivers/infiniband/core/uverbs_std_types_mr.c')
-rw-r--r-- | drivers/infiniband/core/uverbs_std_types_mr.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/infiniband/core/uverbs_std_types_mr.c b/drivers/infiniband/core/uverbs_std_types_mr.c index 610d3b9f7654..997f7a3a558a 100644 --- a/drivers/infiniband/core/uverbs_std_types_mr.c +++ b/drivers/infiniband/core/uverbs_std_types_mr.c @@ -148,7 +148,7 @@ static int UVERBS_HANDLER(UVERBS_METHOD_DM_MR_REG)( return 0; err_dereg: - ib_dereg_mr_user(mr, &attrs->driver_udata); + ib_dereg_mr_user(mr, uverbs_get_cleared_udata(attrs)); return ret; } |