Re: [PATCH rdma-next v1] IB/umad: Fix use-after-free in cdev_put

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Wed, Jan 02, 2019 at 09:30:24PM +0200, Leon Romanovsky wrote:

> > struct ib_umad_file {
> >         struct mutex            mutex;
> >         struct ib_umad_port    *port;
> >         struct list_head        recv_list;
> >         struct list_head        send_list;
> >         struct list_head        port_list;
> >         spinlock_t              send_lock;
> >         wait_queue_head_t       recv_wait;
> >         struct ib_mad_agent    *agent[IB_UMAD_MAX_AGENTS];
> >         int                     agents_dead;
> >         u8                      use_pkey_index;
> >         u8                      already_used;
> > };
> >
> > No 'ib_umad_device' in there.
> 
> At the beginning of ib_umad_close(), there is a line:
> struct ib_umad_device *dev = file->port->umad_dev;
> 
> Because "dev" is not used before ib_umad_dev_put(), compiler probably
> defers evaluation of dev pointer till the end, after "kfree(file);".

C does not allow that kind of re-ordering.

> I don't know what about others, but for us this patch gave two weeks
> of clean runs without traces, which is not the case without it.

Come up with an explanation why it works then?

Thanks
Jason



[Index of Archives]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Photo]     [Yosemite News]     [Yosemite Photos]     [Linux Kernel]     [Linux SCSI]     [XFree86]

  Powered by Linux