Cong Wang cb2595c139 infiniband: fix a possible use-after-free bug ... ucma_process_join() will free the new allocated "mc" struct, if there is any error after that, especially the copy_to_user(). But in parallel, ucma_leave_multicast() could find this "mc" through idr_find() before ucma_process_join() frees it, since it is already published. So "mc" could be used in ucma_leave_multicast() after it is been allocated and freed in ucma_process_join(), since we don't refcnt it. Fix this by separating "publish" from ID allocation, so that we can get an ID first and publish it later after copy_to_user(). Fixes: c8f6a362bf ("RDMA/cma: Add multicast communication support") Reported-by: Noam Rathaus <noamr@beyondsecurity.com> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>		2018-06-04 09:37:03 -06:00
..
core	infiniband: fix a possible use-after-free bug	2018-06-04 09:37:03 -06:00
hw	iw_cxgb4: add INFINIBAND_ADDR_TRANS dependency	2018-06-04 09:35:24 -06:00
sw	Merge branch 'mr_fix' into git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma for-next	2018-05-28 11:44:35 -06:00
ulp	IB/isert: use T10-PI check mask definitions from core layer	2018-06-04 09:19:24 -06:00
Kconfig	RDMA/ucm: Mark UCM interface as BROKEN	2018-05-24 09:39:25 -06:00
Makefile