diff options
| author |   Jack Morgenstein <jackm@dev.mellanox.co.il> | 2019-09-16 10:11:54 +0300 |
|---|---|---|
| committer |   Jason Gunthorpe <jgg@mellanox.com> | 2019-09-16 14:37:38 -0300 |
| commit | 3eca7fc2d8d1275d9cf0c709f0937becbfcf6d96 (patch) | |
| tree | ab1b452246f30cf2ad9a5252c0c2c3dddc37b38d /drivers/infiniband/core | |
| parent | RDMA/efa: Fix incorrect error print (diff) | |
| download | linux-dev-3eca7fc2d8d1275d9cf0c709f0937becbfcf6d96.tar.xz linux-dev-3eca7fc2d8d1275d9cf0c709f0937becbfcf6d96.zip | |
RDMA: Fix double-free in srq creation error flow
The cited commit introduced a double-free of the srq buffer in the error
flow of procedure __uverbs_create_xsrq().
The problem is that ib_destroy_srq_user() called in the error flow also
frees the srq buffer.
Thus, if uverbs_response() fails in __uverbs_create_srq(), the srq buffer
will be freed twice.
Cc: <stable@vger.kernel.org>
Fixes: 68e326dea1db ("RDMA: Handle SRQ allocations by IB/core")
Link: https://lore.kernel.org/r/20190916071154.20383-5-leon@kernel.org
Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Reviewed-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Diffstat (limited to 'drivers/infiniband/core')
| -rw-r--r-- | drivers/infiniband/core/uverbs_cmd.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c index 8f4fd4fac159..13af88da5f79 100644 --- a/drivers/infiniband/core/uverbs_cmd.c +++ b/drivers/infiniband/core/uverbs_cmd.c @@ -3482,7 +3482,8 @@ static int __uverbs_create_xsrq(struct uverbs_attr_bundle *attrs, err_copy: ib_destroy_srq_user(srq, uverbs_get_cleared_udata(attrs)); - + /* It was released in ib_destroy_srq_user */ + srq = NULL; err_free: kfree(srq); err_put: |