diff options
| author |   Parav Pandit <parav@mellanox.com> | 2017-09-24 21:46:30 +0300 |
|---|---|---|
| committer |   Doug Ledford <dledford@redhat.com> | 2017-09-25 11:47:23 -0400 |
| commit | 73827a605bbd7cebef4cfd1261e497246a82a0e7 (patch) | |
| tree | d47f424393f797a944696af1cd06108a319ba46f /drivers/infiniband | |
| parent | IB/core: Fix typo in the name of the tag-matching cap struct (diff) | |
| download | linux-dev-73827a605bbd7cebef4cfd1261e497246a82a0e7.tar.xz linux-dev-73827a605bbd7cebef4cfd1261e497246a82a0e7.zip | |
IB/core: Fix qp_sec use after free access
When security_ib_alloc_security fails, qp->qp_sec memory is freed.
However ib_destroy_qp still tries to access this memory which result
in kernel crash. So its initialized to NULL to avoid such access.
Fixes: d291f1a65232 ("IB/core: Enforce PKey security on QPs")
Signed-off-by: Parav Pandit <parav@mellanox.com>
Reviewed-by: Daniel Jurgens <danielj@mellanox.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Diffstat (limited to 'drivers/infiniband')
| -rw-r--r-- | drivers/infiniband/core/security.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/infiniband/core/security.c b/drivers/infiniband/core/security.c index 70ad19c4c73e..88bdafb297f5 100644 --- a/drivers/infiniband/core/security.c +++ b/drivers/infiniband/core/security.c @@ -432,8 +432,10 @@ int ib_create_qp_security(struct ib_qp *qp, struct ib_device *dev) atomic_set(&qp->qp_sec->error_list_count, 0); init_completion(&qp->qp_sec->error_complete); ret = security_ib_alloc_security(&qp->qp_sec->security); - if (ret) + if (ret) { kfree(qp->qp_sec); + qp->qp_sec = NULL; + } return ret; } |