diff options
| author |   Haggai Eran <haggaie@mellanox.com> | 2015-09-21 16:02:02 +0300 |
|---|---|---|
| committer |   Doug Ledford <dledford@redhat.com> | 2015-10-20 13:13:42 -0400 |
| commit | b3b51f9f6f5d91cd16afaed0c22df2c56ed5f92e (patch) | |
| tree | c1934c46d632a5b5b27fae8525c054770ea552f5 /drivers/infiniband/core/cma.c | |
| parent | IB/core: Fix use after free of ifa (diff) | |
| download | linux-dev-b3b51f9f6f5d91cd16afaed0c22df2c56ed5f92e.tar.xz linux-dev-b3b51f9f6f5d91cd16afaed0c22df2c56ed5f92e.zip | |
IB/cma: Potential NULL dereference in cma_id_from_event
If the lookup of a listening ID failed for an AF_IB request, the code
would try to call dev_put() on a NULL net_dev.
Fixes: be688195bd08 ("IB/cma: Fix net_dev reference leak with failed
requests")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Haggai Eran <haggaie@mellanox.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Diffstat (limited to '')
| -rw-r--r-- | drivers/infiniband/core/cma.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c index 59a2dafc8c57..f163ac680841 100644 --- a/drivers/infiniband/core/cma.c +++ b/drivers/infiniband/core/cma.c @@ -1324,7 +1324,7 @@ static struct rdma_id_private *cma_id_from_event(struct ib_cm_id *cm_id, bind_list = cma_ps_find(rdma_ps_from_service_id(req.service_id), cma_port_from_service_id(req.service_id)); id_priv = cma_find_listener(bind_list, cm_id, ib_event, &req, *net_dev); - if (IS_ERR(id_priv)) { + if (IS_ERR(id_priv) && *net_dev) { dev_put(*net_dev); *net_dev = NULL; } |