]> git.baikalelectronics.ru Git - kernel.git/commit
RDMA/restrack: Increment CQ restrack object before committing
authorLeon Romanovsky <leonro@mellanox.com>
Wed, 14 Feb 2018 10:35:37 +0000 (12:35 +0200)
committerJason Gunthorpe <jgg@mellanox.com>
Thu, 15 Feb 2018 22:31:26 +0000 (15:31 -0700)
commitea97f2973482fc59e8ce77e50cca0215ff485f46
treee35803a9f95ff2fc2f9188ab0f140819a878c1cc
parent39926aa14464f9c64c5efee1ca607b504e063f27
RDMA/restrack: Increment CQ restrack object before committing

Once the uobj is committed it is immediately possible another thread
could destroy it, which worst case, can result in a use-after-free
of the restrack objects.

Cc: syzkaller <syzkaller@googlegroups.com>
Fixes: c76b673bce3d ("RDMA/core: Add resource tracking for create and destroy CQs")
Reported-by: Noa Osherovich <noaos@mellanox.com>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
drivers/infiniband/core/uverbs_cmd.c