Re: [PATCH] RDMA/ocrdma: fix use after free in ocrdma_dealloc_ucontext_pd()

2021-01-11 Thread Selvin Xavier
On Fri, Jan 8, 2021 at 3:13 AM Tom Rix wrote: > > > On 1/7/21 12:41 PM, Jason Gunthorpe wrote: > > On Tue, Dec 29, 2020 at 06:46:53PM -0800, t...@redhat.com wrote: > >> From: Tom Rix > >> > >> In ocrdma_dealloc_ucontext_pd() uctx->cntxt_pd is assigned to > >> the variable pd and then after uctx->

Re: [PATCH] RDMA/ocrdma: fix use after free in ocrdma_dealloc_ucontext_pd()

2021-01-07 Thread Tom Rix
On 1/7/21 12:41 PM, Jason Gunthorpe wrote: > On Tue, Dec 29, 2020 at 06:46:53PM -0800, t...@redhat.com wrote: >> From: Tom Rix >> >> In ocrdma_dealloc_ucontext_pd() uctx->cntxt_pd is assigned to >> the variable pd and then after uctx->cntxt_pd is freed, the >> variable pd is passed to function _

Re: [PATCH] RDMA/ocrdma: fix use after free in ocrdma_dealloc_ucontext_pd()

2021-01-07 Thread Jason Gunthorpe
On Tue, Dec 29, 2020 at 06:46:53PM -0800, t...@redhat.com wrote: > From: Tom Rix > > In ocrdma_dealloc_ucontext_pd() uctx->cntxt_pd is assigned to > the variable pd and then after uctx->cntxt_pd is freed, the > variable pd is passed to function _ocrdma_dealloc_pd() which > dereferences pd directl

Re: [PATCH] RDMA/ocrdma: fix use after free in ocrdma_dealloc_ucontext_pd()

2020-12-29 Thread Leon Romanovsky
On Tue, Dec 29, 2020 at 06:46:53PM -0800, t...@redhat.com wrote: > From: Tom Rix > > In ocrdma_dealloc_ucontext_pd() uctx->cntxt_pd is assigned to > the variable pd and then after uctx->cntxt_pd is freed, the > variable pd is passed to function _ocrdma_dealloc_pd() which > dereferences pd directly

[PATCH] RDMA/ocrdma: fix use after free in ocrdma_dealloc_ucontext_pd()

2020-12-29 Thread trix
From: Tom Rix In ocrdma_dealloc_ucontext_pd() uctx->cntxt_pd is assigned to the variable pd and then after uctx->cntxt_pd is freed, the variable pd is passed to function _ocrdma_dealloc_pd() which dereferences pd directly or through its call to ocrdma_mbx_dealloc_pd(). Reorder the free using the