diff options
author | Jack Morgenstein <jackm@dev.mellanox.co.il> | 2019-09-16 10:11:54 +0300 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2019-10-05 13:14:02 +0200 |
commit | 03d53cb8acb86a6332af752cf7cb916821a4a713 (patch) | |
tree | a458827c84bf372ce11b28a5135cd74e521e16cb /drivers | |
parent | 3d97d7d688e7e9eebc3352dd3dc3ef360a762c23 (diff) | |
download | linux-stable-03d53cb8acb86a6332af752cf7cb916821a4a713.tar.gz linux-stable-03d53cb8acb86a6332af752cf7cb916821a4a713.tar.bz2 linux-stable-03d53cb8acb86a6332af752cf7cb916821a4a713.zip |
RDMA: Fix double-free in srq creation error flow
commit 3eca7fc2d8d1275d9cf0c709f0937becbfcf6d96 upstream.
The cited commit introduced a double-free of the srq buffer in the error
flow of procedure __uverbs_create_xsrq().
The problem is that ib_destroy_srq_user() called in the error flow also
frees the srq buffer.
Thus, if uverbs_response() fails in __uverbs_create_srq(), the srq buffer
will be freed twice.
Cc: <stable@vger.kernel.org>
Fixes: 68e326dea1db ("RDMA: Handle SRQ allocations by IB/core")
Link: https://lore.kernel.org/r/20190916071154.20383-5-leon@kernel.org
Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Reviewed-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers')
-rw-r--r-- | drivers/infiniband/core/uverbs_cmd.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c index 63fe14c7c68f..df8e8ac2c16b 100644 --- a/drivers/infiniband/core/uverbs_cmd.c +++ b/drivers/infiniband/core/uverbs_cmd.c @@ -3477,7 +3477,8 @@ static int __uverbs_create_xsrq(struct uverbs_attr_bundle *attrs, err_copy: ib_destroy_srq_user(srq, uverbs_get_cleared_udata(attrs)); - + /* It was released in ib_destroy_srq_user */ + srq = NULL; err_free: kfree(srq); err_put: |