linux/drivers/infiniband/hw
Leon Romanovsky b4bd701ac4 RDMA/mlx5: Fix multiple NULL-ptr deref errors in rereg_mr flow
Failure in rereg MR releases UMEM but leaves the MR to be destroyed
by the user. As a result the following scenario may happen:
"create MR -> rereg MR with failure -> call to rereg MR again" and
hit "NULL-ptr deref or user memory access" errors.

Ensure that rereg MR is only performed on a non-dead MR.

Cc: syzkaller <syzkaller@googlegroups.com>
Cc: <stable@vger.kernel.org> # 4.5
Fixes: 395a8e4c32 ("IB/mlx5: Refactoring register MR code")
Reported-by: Noa Osherovich <noaos@mellanox.com>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
2018-04-27 11:03:15 -04:00
..
bnxt_re RDMA: Use ib_gid_attr during GID modification 2018-04-03 21:34:16 -06:00
cxgb3 RDMA/cxgb3: Use structs to describe the uABI instead of opencoding 2018-03-22 12:42:48 -06:00
cxgb4 Merge candidates for 4.17 merge window 2018-04-06 17:35:43 -07:00
hfi1 Merge candidates for 4.17 merge window 2018-04-06 17:35:43 -07:00
hns Merge candidates for 4.17 merge window 2018-04-06 17:35:43 -07:00
i40iw i40iw: Remove pre-production workaround for resource profile 1 2018-04-03 13:40:39 -06:00
mlx4 IB/mlx4: Check for egress flow steering 2018-04-04 12:06:24 -06:00
mlx5 RDMA/mlx5: Fix multiple NULL-ptr deref errors in rereg_mr flow 2018-04-27 11:03:15 -04:00
mthca IB/uverbs: Extend uverbs_ioctl header with driver_id 2018-03-19 14:45:17 -06:00
nes IB/uverbs: Extend uverbs_ioctl header with driver_id 2018-03-19 14:45:17 -06:00
ocrdma IB/providers: Avoid null netdev check for RoCE 2018-04-03 21:33:51 -06:00
qedr Merge candidates for 4.17 merge window 2018-04-06 17:35:43 -07:00
qib RDMA: Use u64_to_user_ptr everywhere 2018-03-29 13:42:29 -06:00
usnic Merge candidates for 4.17 merge window 2018-04-06 17:35:43 -07:00
vmw_pvrdma RDMA: Use ib_gid_attr during GID modification 2018-04-03 21:34:16 -06:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00