diff mbox series

[5.4,045/388] RDMA/qedr: Fix potential use after free

Message ID	20200929110012.669519663@linuxfoundation.org
State	New
Headers	show Return-Path: <SRS0=j5F6=DG=vger.kernel.org=stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Pan Bian <bianpan2016@163.com>, =?utf-8?q?Michal_Kalderon=C2=A0?= <michal.kalderon@marvell.com>, Jason Gunthorpe <jgg@mellanox.com>, Sasha Levin <sashal@kernel.org> Subject: [PATCH 5.4 045/388] RDMA/qedr: Fix potential use after free Date: Tue, 29 Sep 2020 12:56:16 +0200 Message-Id: <20200929110012.669519663@linuxfoundation.org> In-Reply-To: <20200929110010.467764689@linuxfoundation.org> References: <20200929110010.467764689@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.4,002/388] scsi: lpfc: Fix pt2pt discovery on SLI3 HBAs [5.4,003/388] scsi: mpt3sas: Free diag buffer without any status check [5.4,004/388] selinux: allow labeling before policy is loaded [5.4,005/388] media: mc-device.c: fix memleak in media_device_register_entity [5.4,006/388] drm/amd/display: Do not double-buffer DTO adjustments [5.4,007/388] drm/amdkfd: Fix race in gfx10 context restore handler [5.4,008/388] dma-fence: Serialise signal enabling (dma_fence_enable_sw_signaling) [5.4,009/388] scsi: qla2xxx: Add error handling for PLOGI ELS passthrough [5.4,010/388] ath10k: fix array out-of-bounds access [5.4,011/388] ath10k: fix memory leak for tpc_stats_final [5.4,012/388] PCI/IOV: Serialize sysfs sriov_numvfs reads vs writes [5.4,013/388] mm: fix double page fault on arm64 if PTE_AF is cleared [5.4,014/388] scsi: aacraid: fix illegal IO beyond last LBA [5.4,015/388] m68k: q40: Fix info-leak in rtc_ioctl [5.4,016/388] xfs: fix inode fork extent count overflow [5.4,017/388] gma/gma500: fix a memory disclosure bug due to uninitialized bytes [5.4,018/388] ASoC: kirkwood: fix IRQ error handling [5.4,019/388] soundwire: intel/cadence: fix startup sequence [5.4,020/388] media: smiapp: Fix error handling at NVM reading [5.4,021/388] drm/amd/display: Free gamma after calculating legacy transfer function [5.4,022/388] xfs: properly serialise fallocate against AIO+DIO [5.4,023/388] leds: mlxreg: Fix possible buffer overflow [5.4,024/388] dm table: do not allow request-based DM to stack on partitions [5.4,025/388] PM / devfreq: tegra30: Fix integer overflow on CPUs freq max out [5.4,026/388] scsi: fnic: fix use after free [5.4,027/388] scsi: lpfc: Fix kernel crash at lpfc_nvme_info_show during remote port bounce [5.4,028/388] powerpc/64s: Always disable branch profiling for prom_init.o [5.4,029/388] net: silence data-races on sk_backlog.tail [5.4,030/388] dax: Fix alloc_dax_region() compile warning [5.4,031/388] iomap: Fix overflow in iomap_page_mkwrite [5.4,032/388] f2fs: avoid kernel panic on corruption test [5.4,033/388] clk/ti/adpll: allocate room for terminating null [5.4,034/388] drm/amdgpu/powerplay: fix AVFS handling with custom powerplay table [5.4,035/388] ice: Fix to change Rx/Tx ring descriptor size via ethtool with DCBx [5.4,036/388] mtd: cfi_cmdset_0002: dont free cfi->cfiq in error path of cfi_amdstd_setup() [5.4,037/388] mfd: mfd-core: Protect against NULL call-back function pointer [5.4,038/388] drm/amdgpu/powerplay/smu7: fix AVFS handling with custom powerplay table [5.4,039/388] tpm_crb: fix fTPM on AMD Zen+ CPUs [5.4,040/388] tracing: Verify if trace array exists before destroying it. [5.4,041/388] tracing: Adding NULL checks for trace_array descriptor pointer [5.4,042/388] bcache: fix a lost wake-up problem caused by mca_cannibalize_lock [5.4,043/388] dmaengine: mediatek: hsdma_probe: fixed a memory leak when devm_request_irq fails [5.4,044/388] x86/kdump: Always reserve the low 1M when the crashkernel option is specified [5.4,045/388] RDMA/qedr: Fix potential use after free [5.4,046/388] RDMA/i40iw: Fix potential use after free [5.4,047/388] PCI: Avoid double hpmemsize MMIO window assignment [5.4,048/388] fix dget_parent() fastpath race [5.4,049/388] xfs: fix attr leaf header freemap.size underflow [5.4,050/388] RDMA/iw_cgxb4: Fix an error handling path in c4iw_connect() [5.4,051/388] ubi: Fix producing anchor PEBs [5.4,052/388] mmc: core: Fix size overflow for mmc partitions [5.4,053/388] gfs2: clean up iopen glock mess in gfs2_create_inode [5.4,054/388] scsi: pm80xx: Cleanup command when a reset times out [5.4,055/388] mt76: do not use devm API for led classdev [5.4,056/388] mt76: add missing locking around ampdu action [5.4,057/388] debugfs: Fix !DEBUG_FS debugfs_create_automount [5.4,058/388] SUNRPC: Capture completion of all RPC tasks [5.4,059/388] CIFS: Use common error handling code in smb2_ioctl_query_info() [5.4,060/388] CIFS: Properly process SMB3 lease breaks [5.4,061/388] f2fs: stop GC when the victim becomes fully valid [5.4,062/388] ASoC: max98090: remove msleep in PLL unlocked workaround [5.4,063/388] xtensa: fix system_call interaction with ptrace [5.4,064/388] s390: avoid misusing CALL_ON_STACK for task stack setup [5.4,065/388] xfs: fix realtime file data space leak [5.4,066/388] drm/amdgpu: fix calltrace during kmd unload(v3) [5.4,067/388] arm64: insn: consistently handle exit text [5.4,068/388] selftests/bpf: De-flake test_tcpbpf [5.4,069/388] kernel/notifier.c: intercept duplicate registrations to avoid infinite loops [5.4,070/388] kernel/sys.c: avoid copying possible padding bytes in copy_to_user [5.4,071/388] KVM: arm/arm64: vgic: Fix potential double free dist->spis in __kvm_vgic_destroy() [5.4,072/388] module: Remove accidental change of module_enable_x() [5.4,073/388] xfs: fix log reservation overflows when allocating large rt extents [5.4,074/388] ALSA: hda: enable regmap internal locking [5.4,075/388] tipc: fix link overflow issue at socket shutdown [5.4,076/388] vcc_seq_next should increase position index [5.4,077/388] neigh_stat_seq_next() should increase position index [5.4,078/388] rt_cpu_seq_next should increase position index [5.4,079/388] ipv6_route_seq_next should increase position index [5.4,080/388] drm/mcde: Handle pending vblank while disabling display [5.4,081/388] seqlock: Require WRITE_ONCE surrounding raw_seqcount_barrier [5.4,082/388] drm/scheduler: Avoid accessing freed bad job. [5.4,083/388] media: ti-vpe: cal: Restrict DMA to avoid memory corruption [5.4,084/388] opp: Replace list_kref with a local counter [5.4,085/388] scsi: qla2xxx: Fix stuck session in GNL [5.4,086/388] scsi: lpfc: Fix incomplete NVME discovery when target [5.4,087/388] sctp: move trace_sctp_probe_path into sctp_outq_sack [5.4,088/388] ACPI: EC: Reference count query handlers under lock [5.4,089/388] scsi: ufs: Make ufshcd_add_command_trace() easier to read [5.4,090/388] scsi: ufs: Fix a race condition in the tracing code [5.4,091/388] drm/amd/display: Initialize DSC PPS variables to 0 [5.4,092/388] i2c: tegra: Prevent interrupt triggering after transfer timeout [5.4,093/388] btrfs: tree-checker: Check leaf chunk item size [5.4,094/388] dmaengine: zynqmp_dma: fix burst length configuration [5.4,095/388] s390/cpum_sf: Use kzalloc and minor changes [5.4,096/388] nfsd: Fix a soft lockup race in nfsd_file_mark_find_or_create() [5.4,097/388] powerpc/eeh: Only dump stack once if an MMIO loop is detected [5.4,098/388] Bluetooth: btrtl: Use kvmalloc for FW allocations [5.4,099/388] tracing: Set kernel_stacks caller size properly [5.4,100/388] ARM: 8948/1: Prevent OOB access in stacktrace [5.4,101/388] ar5523: Add USB ID of SMCWUSBT-G2 wireless adapter [5.4,102/388] ceph: ensure we have a new cap before continuing in fill_inode [5.4,103/388] selftests/ftrace: fix glob selftest [5.4,104/388] tools/power/x86/intel_pstate_tracer: changes for python 3 compatibility [5.4,105/388] Bluetooth: Fix refcount use-after-free issue [5.4,106/388] mm/swapfile.c: swap_next should increase position index [5.4,107/388] mm: pagewalk: fix termination condition in walk_pte_range() [5.4,108/388] Bluetooth: prefetch channel before killing sock [5.4,109/388] KVM: fix overflow of zero page refcount with ksm running [5.4,110/388] ALSA: hda: Clear RIRB status before reading WP [5.4,111/388] skbuff: fix a data race in skb_queue_len() [5.4,112/388] nfsd: Fix a perf warning [5.4,113/388] drm/amd/display: fix workaround for incorrect double buffer register for DLG ADL an... [5.4,114/388] audit: CONFIG_CHANGE dont log internal bookkeeping as an event [5.4,115/388] selinux: sel_avc_get_stat_idx should increase position index [5.4,116/388] scsi: lpfc: Fix RQ buffer leakage when no IOCBs available [5.4,117/388] scsi: lpfc: Fix release of hwq to clear the eq relationship [5.4,118/388] scsi: lpfc: Fix coverity errors in fmdi attribute handling [5.4,119/388] drm/omap: fix possible object reference leak [5.4,120/388] locking/lockdep: Decrement IRQ context counters when removing lock chain [5.4,121/388] clk: stratix10: use do_div() for 64-bit calculation [5.4,122/388] crypto: chelsio - This fixes the kernel panic which occurs during a libkcapi test [5.4,123/388] mt76: clear skb pointers from rx aggregation reorder buffer during cleanup [5.4,124/388] mt76: fix handling full tx queues in mt76_dma_tx_queue_skb_raw [5.4,125/388] ALSA: usb-audio: Dont create a mixer element with bogus volume range [5.4,126/388] perf test: Fix test trace+probe_vfs_getname.sh on s390 [5.4,127/388] RDMA/rxe: Fix configuration of atomic queue pair attributes [5.4,128/388] KVM: x86: fix incorrect comparison in trace event [5.4,129/388] KVM: nVMX: Hold KVMs srcu lock when syncing vmcs12->shadow [5.4,130/388] dmaengine: stm32-mdma: use vchan_terminate_vdesc() in .terminate_all [5.4,131/388] media: staging/imx: Missing assignment in imx_media_capture_device_register() [5.4,132/388] x86/pkeys: Add check for pkey "overflow" [5.4,133/388] bpf: Remove recursion prevention from rcu free callback [5.4,134/388] dmaengine: stm32-dma: use vchan_terminate_vdesc() in .terminate_all [5.4,135/388] dmaengine: tegra-apb: Prevent race conditions on channels freeing [5.4,136/388] soundwire: bus: disable pm_runtime in sdw_slave_delete [5.4,137/388] drm/amd/display: dal_ddc_i2c_payloads_create can fail causing panic [5.4,138/388] drm/omap: dss: Cleanup DSS ports on initialisation failure [5.4,139/388] iavf: use tc_cls_can_offload_and_chain0() instead of chain check [5.4,140/388] firmware: arm_sdei: Use cpus_read_lock() to avoid races with cpuhp [5.4,141/388] random: fix data races at timer_rand_state [5.4,142/388] bus: hisi_lpc: Fixup IO ports addresses to avoid use-after-free in host removal [5.4,143/388] ASoC: SOF: ipc: check ipc return value before data copy [5.4,144/388] media: go7007: Fix URB type for interrupt handling [5.4,145/388] Bluetooth: guard against controllers sending zerod events [5.4,146/388] timekeeping: Prevent 32bit truncation in scale64_check_overflow() [5.4,147/388] powerpc/book3s64: Fix error handling in mm_iommu_do_alloc() [5.4,148/388] drm/amd/display: fix image corruption with ODM 2:1 DSC 2 slice [5.4,149/388] ext4: fix a data race at inode->i_disksize [5.4,150/388] perf jevents: Fix leak of mapfile memory [5.4,151/388] mm: avoid data corruption on CoW fault into PFN-mapped VMA [5.4,152/388] drm/amdgpu: increase atombios cmd timeout [5.4,153/388] ARM: OMAP2+: Handle errors for cpu_pm [5.4,154/388] drm/amd/display: Stop if retimer is not available [5.4,155/388] clk: imx: Fix division by zero warning on pfdv2 [5.4,156/388] cpu-topology: Fix the potential data corruption [5.4,157/388] s390/irq: replace setup_irq() by request_irq() [5.4,158/388] perf cs-etm: Swap packets for instruction samples [5.4,159/388] perf cs-etm: Correct synthesizing instruction samples [5.4,160/388] ath10k: use kzalloc to read for ath10k_sdio_hif_diag_read [5.4,161/388] scsi: aacraid: Disabling TM path and only processing IOP reset [5.4,162/388] Bluetooth: L2CAP: handle l2cap config request during open state [5.4,163/388] media: tda10071: fix unsigned sign extension overflow [5.4,164/388] tty: sifive: Finish transmission before changing the clock [5.4,165/388] xfs: dont ever return a stale pointer from __xfs_dir3_free_read [5.4,166/388] xfs: mark dir corrupt when lookup-by-hash fails [5.4,167/388] ext4: mark block bitmap corrupted when found instead of BUGON [5.4,168/388] tpm: ibmvtpm: Wait for buffer to be set before proceeding [5.4,169/388] rtc: sa1100: fix possible race condition [5.4,170/388] rtc: ds1374: fix possible race condition [5.4,171/388] nfsd: Dont add locks to closed or closing open stateids [5.4,172/388] RDMA/cm: Remove a race freeing timewait_info [5.4,173/388] intel_th: Disallow multi mode on devices where its broken [5.4,174/388] KVM: PPC: Book3S HV: Treat TM-related invalid form instructions on P9 like the vali... [5.4,175/388] drm/msm: fix leaks if initialization fails [5.4,176/388] drm/msm/a5xx: Always set an OPP supported hardware value [5.4,177/388] tracing: Use address-of operator on section symbols [5.4,178/388] thermal: rcar_thermal: Handle probe error gracefully [5.4,179/388] KVM: LAPIC: Mark hrtimer for period or oneshot mode to expire in hard interrupt con... [5.4,180/388] perf parse-events: Fix 3 use after frees found with clang ASAN [5.4,181/388] btrfs: do not init a reloc root if we arent relocating [5.4,182/388] btrfs: free the reloc_control in a consistent way [5.4,183/388] r8169: improve RTL8168b FIFO overflow workaround [5.4,184/388] serial: 8250_port: Dont service RX FIFO if throttled [5.4,185/388] serial: 8250_omap: Fix sleeping function called from invalid context during probe [5.4,186/388] serial: 8250: 8250_omap: Terminate DMA before pushing data on RX timeout [5.4,187/388] perf cpumap: Fix snprintf overflow check [5.4,188/388] net: axienet: Convert DMA error handler to a work queue [5.4,189/388] net: axienet: Propagate failure of DMA descriptor setup [5.4,190/388] cpufreq: powernv: Fix frame-size-overflow in powernv_cpufreq_work_fn [5.4,191/388] tools: gpio-hammer: Avoid potential overflow in main [5.4,192/388] exec: Add exec_update_mutex to replace cred_guard_mutex [5.4,193/388] exec: Fix a deadlock in strace [5.4,194/388] selftests/ptrace: add test cases for dead-locks [5.4,195/388] kernel/kcmp.c: Use new infrastructure to fix deadlocks in execve [5.4,196/388] proc: Use new infrastructure to fix deadlocks in execve [5.4,197/388] proc: io_accounting: Use new infrastructure to fix deadlocks in execve [5.4,198/388] perf: Use new infrastructure to fix deadlocks in execve [5.4,199/388] nvme-multipath: do not reset on unknown status [5.4,200/388] nvme: Fix ctrl use-after-free during sysfs deletion [5.4,201/388] nvme: Fix controller creation races with teardown flow [5.4,202/388] brcmfmac: Fix double freeing in the fmac usb data path [5.4,203/388] xfs: prohibit fs freezing when using empty transactions [5.4,204/388] RDMA/rxe: Set sys_image_guid to be aligned with HW IB devices [5.4,205/388] IB/iser: Always check sig MR before putting it to the free pool [5.4,206/388] scsi: hpsa: correct race condition in offload enabled [5.4,207/388] SUNRPC: Fix a potential buffer overflow in svc_print_xprts() [5.4,208/388] svcrdma: Fix leak of transport addresses [5.4,209/388] netfilter: nf_tables: silence a RCU-list warning in nft_table_lookup() [5.4,210/388] PCI: Use ioremap(), not phys_to_virt() for platform ROM [5.4,211/388] ubifs: ubifs_jnl_write_inode: Fix a memory leak bug [5.4,212/388] ubifs: ubifs_add_orphan: Fix a memory leak bug [5.4,213/388] ubifs: Fix out-of-bounds memory access caused by abnormal value of node_len [5.4,214/388] ALSA: usb-audio: Fix case when USB MIDI interface has more than one extra endpoint ... [5.4,215/388] PCI: pciehp: Fix MSI interrupt race [5.4,216/388] NFS: Fix races nfs_page_group_destroy() vs nfs_destroy_unlinked_subrequests() [5.4,217/388] drm/amdgpu/vcn2.0: stall DPG when WPTR/RPTR reset [5.4,218/388] powerpc/perf: Implement a global lock to avoid races between trace, core and thread... [5.4,219/388] mm/kmemleak.c: use address-of operator on section symbols [5.4,220/388] mm/filemap.c: clear page error before actual read [5.4,221/388] mm/swapfile: fix data races in try_to_unuse() [5.4,222/388] mm/vmscan.c: fix data races using kswapd_classzone_idx [5.4,223/388] SUNRPC: Dont start a timer on an already queued rpc task [5.4,224/388] nvmet-rdma: fix double free of rdma queue [5.4,225/388] workqueue: Remove the warning in wq_worker_sleeping() [5.4,226/388] drm/amdgpu/sriov add amdgpu_amdkfd_pre_reset in gpu reset [5.4,227/388] mm/mmap.c: initialize align_offset explicitly for vm_unmapped_area [5.4,228/388] ALSA: hda: Skip controller resume if not needed [5.4,229/388] scsi: qedi: Fix termination timeouts in session logout [5.4,230/388] serial: uartps: Wait for tx_empty in console setup [5.4,231/388] btrfs: fix setting last_trans for reloc roots [5.4,232/388] KVM: Remove CREATE_IRQCHIP/SET_PIT2 race [5.4,233/388] perf stat: Force error in fallback on :k events [5.4,234/388] bdev: Reduce time holding bd_mutex in sync in blkdev_close() [5.4,235/388] drivers: char: tlclk.c: Avoid data race between init and interrupt handler [5.4,236/388] KVM: arm64: vgic-v3: Retire all pending LPIs on vcpu destroy [5.4,237/388] KVM: arm64: vgic-its: Fix memory leak on the error path of vgic_add_lpi() [5.4,238/388] net: openvswitch: use u64 for meter bucket [5.4,239/388] scsi: aacraid: Fix error handling paths in aac_probe_one() [5.4,240/388] staging:r8188eu: avoid skb_clone for amsdu to msdu conversion [5.4,241/388] sparc64: vcc: Fix error return code in vcc_probe() [5.4,242/388] arm64: cpufeature: Relax checks for AArch32 support at EL[0-2] [5.4,243/388] sched/fair: Eliminate bandwidth race between throttling and distribution [5.4,244/388] dpaa2-eth: fix error return code in setup_dpni() [5.4,245/388] dt-bindings: sound: wm8994: Correct required supplies based on actual implementaion [5.4,246/388] devlink: Fix reporters recovery condition [5.4,247/388] atm: fix a memory leak of vcc->user_back [5.4,248/388] media: venus: vdec: Init registered list unconditionally [5.4,249/388] perf mem2node: Avoid double free related to realloc [5.4,250/388] mm/slub: fix incorrect interpretation of s->offset [5.4,251/388] i2c: tegra: Restore pinmux on system resume [5.4,252/388] power: supply: max17040: Correct voltage reading [5.4,253/388] phy: samsung: s5pv210-usb2: Add delay after reset [5.4,254/388] Bluetooth: Handle Inquiry Cancel error after Inquiry Complete [5.4,255/388] USB: EHCI: ehci-mv: fix error handling in mv_ehci_probe() [5.4,256/388] KVM: x86: handle wrap around 32-bit address space [5.4,257/388] tipc: fix memory leak in service subscripting [5.4,258/388] tty: serial: samsung: Correct clock selection logic [5.4,259/388] ALSA: hda: Fix potential race in unsol event handler [5.4,260/388] drm/exynos: dsi: Remove bridge node reference in error handling path in probe function [5.4,261/388] ipmi:bt-bmc: Fix error handling and status check [5.4,262/388] powerpc/traps: Make unrecoverable NMIs die instead of panic [5.4,263/388] svcrdma: Fix backchannel return code [5.4,264/388] fuse: dont check refcount after stealing page [5.4,265/388] fuse: update attr_version counter on fuse_notify_inval_inode() [5.4,266/388] USB: EHCI: ehci-mv: fix less than zero comparison of an unsigned int [5.4,267/388] coresight: etm4x: Fix use-after-free of per-cpu etm drvdata [5.4,268/388] arm64: acpi: Make apei_claim_sea() synchronise with APEIs irq work [5.4,269/388] scsi: cxlflash: Fix error return code in cxlflash_probe() [5.4,270/388] arm64/cpufeature: Drop TraceFilt feature exposure from ID_DFR0 register [5.4,271/388] drm/amdkfd: fix restore worker race condition [5.4,272/388] e1000: Do not perform reset in reset_task if we are already down [5.4,273/388] drm/nouveau/debugfs: fix runtime pm imbalance on error [5.4,274/388] drm/nouveau: fix runtime pm imbalance on error [5.4,275/388] drm/nouveau/dispnv50: fix runtime pm imbalance on error [5.4,276/388] printk: handle blank console arguments passed in. [5.4,277/388] usb: dwc3: Increase timeout for CmdAct cleared by device controller [5.4,278/388] btrfs: dont force read-only after error in drop snapshot [5.4,279/388] btrfs: fix double __endio_write_update_ordered in direct I/O [5.4,280/388] gpio: rcar: Fix runtime PM imbalance on error [5.4,281/388] vfio/pci: fix memory leaks of eventfd ctx [5.4,282/388] KVM: PPC: Book3S HV: Close race with page faults around memslot flushes [5.4,283/388] perf evsel: Fix 2 memory leaks [5.4,284/388] perf trace: Fix the selection for architectures to generate the errno name tables [5.4,285/388] perf stat: Fix duration_time value for higher intervals [5.4,286/388] perf util: Fix memory leak of prefix_if_not_in [5.4,287/388] perf metricgroup: Free metric_events on error [5.4,288/388] perf kcore_copy: Fix module map when there are no modules loaded [5.4,289/388] PCI: tegra194: Fix runtime PM imbalance on error [5.4,290/388] ASoC: img-i2s-out: Fix runtime PM imbalance on error [5.4,291/388] wlcore: fix runtime pm imbalance in wl1271_tx_work [5.4,292/388] wlcore: fix runtime pm imbalance in wlcore_regdomain_config [5.4,293/388] mtd: rawnand: gpmi: Fix runtime PM imbalance on error [5.4,294/388] mtd: rawnand: omap_elm: Fix runtime PM imbalance on error [5.4,295/388] PCI: tegra: Fix runtime PM imbalance on error [5.4,296/388] ceph: fix potential race in ceph_check_caps [5.4,297/388] mm/swap_state: fix a data race in swapin_nr_pages [5.4,298/388] mm: memcontrol: fix stat-corrupting race in charge moving [5.4,299/388] rapidio: avoid data race between file operation callbacks and mport_cdev_add(). [5.4,300/388] mtd: parser: cmdline: Support MTD names containing one or more colons [5.4,301/388] x86/speculation/mds: Mark mds_user_clear_cpu_buffers() __always_inline [5.4,302/388] NFS: nfs_xdr_status should record the procedure name [5.4,303/388] vfio/pci: Clear error and request eventfd ctx after releasing [5.4,304/388] cifs: Fix double add page to memcg when cifs_readpages [5.4,305/388] nvme: fix possible deadlock when I/O is blocked [5.4,306/388] mac80211: skip mpath lookup also for control port tx [5.4,307/388] scsi: libfc: Handling of extra kref [5.4,308/388] scsi: libfc: Skip additional kref updating work event [5.4,309/388] selftests/x86/syscall_nt: Clear weird flags after each test [5.4,310/388] vfio/pci: fix racy on error and request eventfd ctx [5.4,311/388] btrfs: qgroup: fix data leak caused by race between writeback and truncate [5.4,312/388] perf tests: Fix test 68 zstd compression for s390 [5.4,313/388] scsi: qla2xxx: Retry PLOGI on FC-NVMe PRLI failure [5.4,314/388] ubi: fastmap: Free unused fastmap anchor peb during detach [5.4,315/388] mt76: fix LED link time failure [5.4,316/388] opp: Increase parsed_static_opps in _of_add_opp_table_v1() [5.4,317/388] perf parse-events: Use strcmp() to compare the PMU name [5.4,318/388] ALSA: hda: Always use jackpoll helper for jack update after resume [5.4,319/388] ALSA: hda: Workaround for spurious wakeups on some Intel platforms [5.4,320/388] net: openvswitch: use div_u64() for 64-by-32 divisions [5.4,321/388] nvme: explicitly update mpath disk capacity on revalidation [5.4,322/388] device_cgroup: Fix RCU list debugging warning [5.4,323/388] ASoC: pcm3168a: ignore 0 Hz settings [5.4,324/388] ASoC: wm8994: Skip setting of the WM8994_MICBIAS register for WM1811 [5.4,325/388] ASoC: wm8994: Ensure the device is resumed in wm89xx_mic_detect functions [5.4,326/388] ASoC: Intel: bytcr_rt5640: Add quirk for MPMAN Converter9 2-in-1 [5.4,327/388] RISC-V: Take text_mutex in ftrace_init_nop() [5.4,328/388] i2c: aspeed: Mask IRQ status to relevant bits [5.4,329/388] s390/init: add missing __init annotations [5.4,330/388] lockdep: fix order in trace_hardirqs_off_caller() [5.4,331/388] EDAC/ghes: Check whether the driver is on the safe list correctly [5.4,332/388] drm/amdkfd: fix a memory leak issue [5.4,333/388] drm/amd/display: update nv1x stutter latencies [5.4,334/388] drm/amdgpu/dc: Require primary plane to be enabled whenever the CRTC is [5.4,335/388] i2c: core: Call i2c_acpi_install_space_handler() before i2c_acpi_register_devices() [5.4,336/388] objtool: Fix noreturn detection for ignored functions [5.4,337/388] ieee802154: fix one possible memleak in ca8210_dev_com_init [5.4,338/388] ieee802154/adf7242: check status of adf7242_read_reg [5.4,339/388] clocksource/drivers/h8300_timer8: Fix wrong return value in h8300_8timer_init() [5.4,340/388] mwifiex: Increase AES key storage size to 256 bits [5.4,341/388] batman-adv: bla: fix type misuse for backbone_gw hash indexing [5.4,342/388] atm: eni: fix the missed pci_disable_device() for eni_init_one() [5.4,343/388] batman-adv: mcast/TT: fix wrongly dropped or rerouted packets [5.4,344/388] netfilter: conntrack: nf_conncount_init is failing with IPv6 disabled [5.4,345/388] mac802154: tx: fix use-after-free [5.4,346/388] bpf: Fix clobbering of r2 in bpf_gen_ld_abs [5.4,347/388] drm/vc4/vc4_hdmi: fill ASoC card owner [5.4,348/388] net: qed: Disable aRFS for NPAR and 100G [5.4,349/388] net: qede: Disable aRFS for NPAR and 100G [5.4,350/388] net: qed: RDMA personality shouldnt fail VF load [5.4,351/388] drm/sun4i: sun8i-csc: Secondary CSC register correction [5.4,352/388] batman-adv: Add missing include for in_interrupt() [5.4,353/388] nvme-tcp: fix kconfig dependency warning when !CRYPTO [5.4,354/388] batman-adv: mcast: fix duplicate mcast packets in BLA backbone from LAN [5.4,355/388] batman-adv: mcast: fix duplicate mcast packets in BLA backbone from mesh [5.4,356/388] batman-adv: mcast: fix duplicate mcast packets from BLA backbone to mesh [5.4,357/388] bpf: Fix a rcu warning for bpffs map pretty-print [5.4,358/388] lib80211: fix unmet direct dependendices config warning when !CRYPTO [5.4,359/388] ALSA: asihpi: fix iounmap in error handler [5.4,360/388] regmap: fix page selection for noinc reads [5.4,361/388] regmap: fix page selection for noinc writes [5.4,362/388] MIPS: Add the missing CPU_1074K into __get_cpu_type() [5.4,363/388] regulator: axp20x: fix LDO2/4 description [5.4,364/388] KVM: x86: Reset MMU context if guest toggles CR4.SMAP or CR4.PKE [5.4,365/388] KVM: SVM: Add a dedicated INVD intercept routine [5.4,366/388] mm: validate pmd after splitting [5.4,367/388] arch/x86/lib/usercopy_64.c: fix __copy_user_flushcache() cache writeback [5.4,368/388] x86/ioapic: Unbreak check_timer() [5.4,369/388] scsi: lpfc: Fix initial FLOGI failure due to BBSCN not supported [5.4,370/388] ALSA: usb-audio: Add delay quirk for H570e USB headsets [5.4,371/388] ALSA: hda/realtek - Couldnt detect Mic if booting with headset plugged [5.4,372/388] ALSA: hda/realtek: Enable front panel headset LED on Lenovo ThinkStation P520 [5.4,373/388] lib/string.c: implement stpcpy [5.4,374/388] tracing: fix double free [5.4,375/388] s390/dasd: Fix zero write for FBA devices [5.4,376/388] kprobes: Fix to check probe enabled before disarm_kprobe_ftrace() [5.4,377/388] kprobes: tracing/kprobes: Fix to kill kprobes on initmem after boot [5.4,378/388] btrfs: fix overflow when copying corrupt csums for a message [5.4,379/388] dmabuf: fix NULL pointer dereference in dma_buf_release() [5.4,380/388] mm, THP, swap: fix allocating cluster for swapfile by mistake [5.4,381/388] mm/gup: fix gup_fast with dynamic page table folding [5.4,382/388] s390/zcrypt: Fix ZCRYPT_PERDEV_REQCNT ioctl [5.4,383/388] KVM: arm64: Assume write fault on S1PTW permission fault on instruction fetch [5.4,384/388] dm: fix bio splitting and its bio completion order for regular IO [5.4,385/388] kprobes: Fix compiler warning for !CONFIG_KPROBES_ON_FTRACE [5.4,386/388] ata: define AC_ERR_OK [5.4,387/388] ata: make qc_prep return ata_completion_errors [5.4,388/388] ata: sata_mv, avoid trigerrable BUG_ON

Commit Message

Greg KH Sept. 29, 2020, 10:56 a.m. UTC

From: Pan Bian <bianpan2016@163.com>

[ Upstream commit 960657b732e1ce21b07be5ab48a7ad3913d72ba4 ]

Move the release operation after error log to avoid possible use after
free.

Link: https://lore.kernel.org/r/1573021434-18768-1-git-send-email-bianpan2016@163.com
Signed-off-by: Pan Bian <bianpan2016@163.com>
Acked-by: Michal Kalderon <michal.kalderon@marvell.com>
Reviewed-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/infiniband/hw/qedr/qedr_iw_cm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff mbox series

Patch

diff --git a/drivers/infiniband/hw/qedr/qedr_iw_cm.c b/drivers/infiniband/hw/qedr/qedr_iw_cm.c
index a7a926b7b5628..6dea49e11f5f0 100644
--- a/drivers/infiniband/hw/qedr/qedr_iw_cm.c
+++ b/drivers/infiniband/hw/qedr/qedr_iw_cm.c
@@ -490,10 +490,10 @@  qedr_addr6_resolve(struct qedr_dev *dev,
 
 	if ((!dst) || dst->error) {
 		if (dst) {
-			dst_release(dst);
 			DP_ERR(dev,
 			       "ip6_route_output returned dst->error = %d\n",
 			       dst->error);
+			dst_release(dst);
 		}
 		return -EINVAL;
 	}