This is a note to let you know that I've just added the patch titled
RDMA/bnxt_re: Properly order ib_device_unalloc() to avoid UAF
to the 6.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
rdma-bnxt_re-properly-order-ib_device_unalloc-to-avoid-uaf.patch
and it can be found in the queue-6.4 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 5363fc488da579923edf6a2fdca3d3b651dd800b Mon Sep 17 00:00:00 2001
From: Selvin Xavier <selvin.xavier@xxxxxxxxxxxx>
Date: Wed, 9 Aug 2023 21:44:35 -0700
Subject: RDMA/bnxt_re: Properly order ib_device_unalloc() to avoid UAF
From: Selvin Xavier <selvin.xavier@xxxxxxxxxxxx>
commit 5363fc488da579923edf6a2fdca3d3b651dd800b upstream.
ib_dealloc_device() should be called only after device cleanup. Fix the
dealloc sequence.
Fixes: 6d758147c7b8 ("RDMA/bnxt_re: Use auxiliary driver interface")
Link: https://lore.kernel.org/r/1691642677-21369-2-git-send-email-selvin.xavier@xxxxxxxxxxxx
Signed-off-by: Selvin Xavier <selvin.xavier@xxxxxxxxxxxx>
Signed-off-by: Jason Gunthorpe <jgg@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
drivers/infiniband/hw/bnxt_re/main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/infiniband/hw/bnxt_re/main.c
+++ b/drivers/infiniband/hw/bnxt_re/main.c
@@ -1425,8 +1425,8 @@ static void bnxt_re_remove(struct auxili
}
bnxt_re_setup_cc(rdev, false);
ib_unregister_device(&rdev->ibdev);
- ib_dealloc_device(&rdev->ibdev);
bnxt_re_dev_uninit(rdev);
+ ib_dealloc_device(&rdev->ibdev);
skip_remove:
mutex_unlock(&bnxt_re_mutex);
}
Patches currently in stable-queue which might be from selvin.xavier@xxxxxxxxxxxx are
queue-6.4/rdma-bnxt_re-properly-order-ib_device_unalloc-to-avoid-uaf.patch
queue-6.4/rdma-bnxt_re-fix-error-handling-in-probe-failure-path.patch
