{"id":819408,"url":"http://patchwork.ozlabs.org/api/patches/819408/?format=json","web_url":"http://patchwork.ozlabs.org/project/netdev/patch/20170928044132.30940-2-saeedm@mellanox.com/","project":{"id":7,"url":"http://patchwork.ozlabs.org/api/projects/7/?format=json","name":"Linux network development","link_name":"netdev","list_id":"netdev.vger.kernel.org","list_email":"netdev@vger.kernel.org","web_url":null,"scm_url":null,"webscm_url":null,"list_archive_url":"","list_archive_url_format":"","commit_url_format":""},"msgid":"<20170928044132.30940-2-saeedm@mellanox.com>","list_archive_url":null,"date":"2017-09-28T04:41:22","name":"[net,01/11] net/mlx5e: IPoIB, Fix access to invalid memory address","commit_ref":null,"pull_url":null,"state":"accepted","archived":true,"hash":"2cdebd14706eeac224d8b24f45b255df34969c14","submitter":{"id":65299,"url":"http://patchwork.ozlabs.org/api/people/65299/?format=json","name":"Saeed Mahameed","email":"saeedm@mellanox.com"},"delegate":{"id":34,"url":"http://patchwork.ozlabs.org/api/users/34/?format=json","username":"davem","first_name":"David","last_name":"Miller","email":"davem@davemloft.net"},"mbox":"http://patchwork.ozlabs.org/project/netdev/patch/20170928044132.30940-2-saeedm@mellanox.com/mbox/","series":[{"id":5488,"url":"http://patchwork.ozlabs.org/api/series/5488/?format=json","web_url":"http://patchwork.ozlabs.org/project/netdev/list/?series=5488","date":"2017-09-28T04:41:23","name":"Mellanox, mlx5 fixes 2017-09-28","version":1,"mbox":"http://patchwork.ozlabs.org/series/5488/mbox/"}],"comments":"http://patchwork.ozlabs.org/api/patches/819408/comments/","check":"pending","checks":"http://patchwork.ozlabs.org/api/patches/819408/checks/","tags":{},"related":[],"headers":{"Return-Path":"","X-Original-To":"patchwork-incoming@ozlabs.org","Delivered-To":"patchwork-incoming@ozlabs.org","Authentication-Results":"ozlabs.org;\n\tspf=none (mailfrom) smtp.mailfrom=vger.kernel.org\n\t(client-ip=209.132.180.67; helo=vger.kernel.org;\n\tenvelope-from=netdev-owner@vger.kernel.org;\n\treceiver=)","Received":["from vger.kernel.org (vger.kernel.org [209.132.180.67])\n\tby ozlabs.org (Postfix) with ESMTP id 3y2hrK25wdz9t3x\n\tfor ;\n\tThu, 28 Sep 2017 14:42:41 +1000 (AEST)","(majordomo@vger.kernel.org) by vger.kernel.org via listexpand\n\tid S1752046AbdI1Emk (ORCPT );\n\tThu, 28 Sep 2017 00:42:40 -0400","from mail-il-dmz.mellanox.com ([193.47.165.129]:54366 \"EHLO\n\tmellanox.co.il\" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org\n\twith ESMTP id S1751082AbdI1EmF (ORCPT\n\t); Thu, 28 Sep 2017 00:42:05 -0400","from Internal Mail-Server by MTLPINE1 (envelope-from\n\tsaeedm@mellanox.com)\n\twith ESMTPS (AES256-SHA encrypted); 28 Sep 2017 06:42:01 +0200","from sws.mtl.labs.mlnx (reg-l-vrt-045-015.mtl.labs.mlnx\n\t[10.135.45.15])\n\tby labmailer.mlnx (8.13.8/8.13.8) with ESMTP id v8S4g1j5011096;\n\tThu, 28 Sep 2017 07:42:01 +0300"],"From":"Saeed Mahameed ","To":"\"David S. Miller\" ","Cc":"netdev@vger.kernel.org, Roi Dayan ,\n\tSaeed Mahameed ","Subject":"[net 01/11] net/mlx5e: IPoIB, Fix access to invalid memory address","Date":"Thu, 28 Sep 2017 07:41:22 +0300","Message-Id":"<20170928044132.30940-2-saeedm@mellanox.com>","X-Mailer":"git-send-email 2.13.0","In-Reply-To":"<20170928044132.30940-1-saeedm@mellanox.com>","References":"<20170928044132.30940-1-saeedm@mellanox.com>","Sender":"netdev-owner@vger.kernel.org","Precedence":"bulk","List-ID":"","X-Mailing-List":"netdev@vger.kernel.org"},"content":"From: Roi Dayan \n\nWhen cleaning rdma netdevice we need to save the mdev pointer\nbecause priv is released when we release netdev.\n\nThis bug was found using the kernel address sanitizer (KASAN).\nuse-after-free in mlx5_rdma_netdev_free+0xe3/0x100 [mlx5_core]\n\nFixes: 48935bbb7ae8 (\"net/mlx5e: IPoIB, Add netdevice profile skeleton\")\nSigned-off-by: Roi Dayan \nReviewed-by: Or Gerlitz \nSigned-off-by: Saeed Mahameed \n---\n drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c | 3 ++-\n 1 file changed, 2 insertions(+), 1 deletion(-)","diff":"diff --git a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c\nindex 85298051a3e4..145e392ab849 100644\n--- a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c\n+++ b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c\n@@ -572,12 +572,13 @@ void mlx5_rdma_netdev_free(struct net_device *netdev)\n {\n \tstruct mlx5e_priv *priv = mlx5i_epriv(netdev);\n \tconst struct mlx5e_profile *profile = priv->profile;\n+\tstruct mlx5_core_dev *mdev = priv->mdev;\n \n \tmlx5e_detach_netdev(priv);\n \tprofile->cleanup(priv);\n \tdestroy_workqueue(priv->wq);\n \tfree_netdev(netdev);\n \n-\tmlx5e_destroy_mdev_resources(priv->mdev);\n+\tmlx5e_destroy_mdev_resources(mdev);\n }\n EXPORT_SYMBOL(mlx5_rdma_netdev_free);\n","prefixes":["net","01/11"]}