summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorSelvin Xavier <selvin.xavier@broadcom.com>2023-08-09 21:44:35 -0700
committerJason Gunthorpe <jgg@nvidia.com>2023-08-10 16:35:54 -0300
commit5363fc488da579923edf6a2fdca3d3b651dd800b (patch)
tree3becd778ec5b48fe6841b246d26a49a6e3940342
parent8e7b295da1ed051baedd068b7f785f5d959ef95d (diff)
RDMA/bnxt_re: Properly order ib_device_unalloc() to avoid UAF
ib_dealloc_device() should be called only after device cleanup. Fix the dealloc sequence. Fixes: 6d758147c7b8 ("RDMA/bnxt_re: Use auxiliary driver interface") Link: https://lore.kernel.org/r/1691642677-21369-2-git-send-email-selvin.xavier@broadcom.com Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
-rw-r--r--drivers/infiniband/hw/bnxt_re/main.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/infiniband/hw/bnxt_re/main.c b/drivers/infiniband/hw/bnxt_re/main.c
index b42166fe7454..1c7646057893 100644
--- a/drivers/infiniband/hw/bnxt_re/main.c
+++ b/drivers/infiniband/hw/bnxt_re/main.c
@@ -1526,8 +1526,8 @@ static void bnxt_re_remove(struct auxiliary_device *adev)
}
bnxt_re_setup_cc(rdev, false);
ib_unregister_device(&rdev->ibdev);
- ib_dealloc_device(&rdev->ibdev);
bnxt_re_dev_uninit(rdev);
+ ib_dealloc_device(&rdev->ibdev);
skip_remove:
mutex_unlock(&bnxt_re_mutex);
}