diff options
| author | Jason Gunthorpe | 2015-08-05 01:13:32 +0200 |
|---|---|---|
| committer | Doug Ledford | 2015-08-29 04:54:48 +0200 |
| commit | 7e967fd0b84a843b2475acc67a5a8df138c5f5c0 (patch) | |
| tree | 3b3fce60c75058d1d5ce891b6c1dc7efca549d6f /drivers/ntb/Kconfig | |
| parent | iw_cxgb4: set the default MPA version to 2 (diff) | |
| download | kernel-qcow2-linux-7e967fd0b84a843b2475acc67a5a8df138c5f5c0.tar.gz kernel-qcow2-linux-7e967fd0b84a843b2475acc67a5a8df138c5f5c0.tar.xz kernel-qcow2-linux-7e967fd0b84a843b2475acc67a5a8df138c5f5c0.zip | |
IB/ucma: Fix theoretical user triggered use-after-free
Something like this:
CPU A CPU B
Acked-by: Sean Hefty <sean.hefty@intel.com>
======================== ================================
ucma_destroy_id()
wait_for_completion()
.. anything
ucma_put_ctx()
complete()
.. continues ...
ucma_leave_multicast()
mutex_lock(mut)
atomic_inc(ctx->ref)
mutex_unlock(mut)
ucma_free_ctx()
ucma_cleanup_multicast()
mutex_lock(mut)
kfree(mc)
rdma_leave_multicast(mc->ctx->cm_id,..
Fix it by latching the ref at 0. Once it goes to 0 mc and ctx cannot
leave the mutex(mut) protection.
The other atomic_inc in ucma_get_ctx is OK because mutex(mut) protects
it from racing with ucma_destroy_id.
Signed-off-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
Acked-by: Sean Hefty <sean.hefty@intel.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Diffstat (limited to 'drivers/ntb/Kconfig')
0 files changed, 0 insertions, 0 deletions