Re: [PATCH] RDMA/core: Fix use-after-free in ib_get_eth_speed()
Jason Gunthorpe <[email protected]>
| Newsgroups | org.kernel.vger.linux-rdma,org.kernel.vger.netdev |
|---|---|
| Message-ID | <[email protected]> |
On Fri, Aug 21, 2026 at 07:05:12AM +0000, Eric Dumazet wrote:
> In ib_get_eth_speed(), dev_put(netdev) is called before inspecting
> rc and dereferencing netdev->name in pr_warn(). If dev_put() drops
> the final reference to netdev, netdev->name accesses freed memory.
>
> Move dev_put(netdev) after the warning block so netdev is kept
> alive while its name is read.
>
> Fixes: d41861942fc5 ("IB/core: Add generic function to extract IB speed from netdev")
> Signed-off-by: Eric Dumazet <[email protected]>
> ---
> drivers/infiniband/core/verbs.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
I was intending to take this patch next cycle:
https://patchwork.kernel.org/project/linux-rdma/patch/[email protected]/
Which has the same change embedded?
Jason