Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

IB/core: Fix qp_sec use after free access

When security_ib_alloc_security fails, qp->qp_sec memory is freed.
However ib_destroy_qp still tries to access this memory which result
in kernel crash. So its initialized to NULL to avoid such access.

Fixes: d291f1a65232 ("IB/core: Enforce PKey security on QPs")
Signed-off-by: Parav Pandit <parav@mellanox.com>
Reviewed-by: Daniel Jurgens <danielj@mellanox.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Doug Ledford <dledford@redhat.com>

authored by

Parav Pandit and committed by
Doug Ledford
73827a60 78b1beb0

+3 -1
+3 -1
drivers/infiniband/core/security.c
··· 432 432 atomic_set(&qp->qp_sec->error_list_count, 0); 433 433 init_completion(&qp->qp_sec->error_complete); 434 434 ret = security_ib_alloc_security(&qp->qp_sec->security); 435 - if (ret) 435 + if (ret) { 436 436 kfree(qp->qp_sec); 437 + qp->qp_sec = NULL; 438 + } 437 439 438 440 return ret; 439 441 }