diff options
| author | Jack Morgenstein <jackm@dev.mellanox.co.il> | 2019-09-16 10:11:54 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2019-10-05 15:12:15 +0200 |
| commit | 102d735feeb198466f5f86670bc77c58bfc524a0 (patch) | |
| tree | d26ffdc48660f1ea6bb0f020408785f1cb440087 /scripts/gcc-plugins/randomize_layout_plugin.c | |
| parent | 5b4651af6a079032c60c532e3b3c0b3a9de95bb1 (diff) | |
RDMA: Fix double-free in srq creation error flow
commit 3eca7fc2d8d1275d9cf0c709f0937becbfcf6d96 upstream.
The cited commit introduced a double-free of the srq buffer in the error
flow of procedure __uverbs_create_xsrq().
The problem is that ib_destroy_srq_user() called in the error flow also
frees the srq buffer.
Thus, if uverbs_response() fails in __uverbs_create_srq(), the srq buffer
will be freed twice.
Cc: <stable@vger.kernel.org>
Fixes: 68e326dea1db ("RDMA: Handle SRQ allocations by IB/core")
Link: https://lore.kernel.org/r/20190916071154.20383-5-leon@kernel.org
Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Reviewed-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'scripts/gcc-plugins/randomize_layout_plugin.c')
0 files changed, 0 insertions, 0 deletions