On Mon, Mar 19, 2018 at 02:20:15PM +0200, Leon Romanovsky wrote:
> From: Leon Romanovsky <leonro@xxxxxxxxxxxx>
>
> The error in ucma_create_id() left ctx in the list of contexts belong
> to ucma file descriptor. The attempt to close this file descriptor causes
> to use-after-free accesses while iterating over such list.
>
> Fixes: 75216638572f ("RDMA/cma: Export rdma cm interface to userspace")
> Reported-by: <syzbot+dcfd344365a56fbebd0f@xxxxxxxxxxxxxxxxxxxxxxxxx>
> Signed-off-by: Leon Romanovsky <leonro@xxxxxxxxxxxx>
> Reviewed-by: Sean Hefty <sean.hefty@xxxxxxxxx>
> drivers/infiniband/core/ucma.c | 3 +++
> 1 file changed, 3 insertions(+)
Applied to for-rc, thanks
Jason
--
To unsubscribe from this list: send the line "unsubscribe linux-rdma" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
