Re: [PATCH] RDMA/core: Fix use-after-free in ib_get_eth_speed()

On Fri, Aug 21, 2026 at 3:26 PM Jason Gunthorpe <[email protected]> wrote:
>
> On Fri, Aug 21, 2026 at 07:05:12AM +0000, Eric Dumazet wrote:
> > In ib_get_eth_speed(), dev_put(netdev) is called before inspecting
> > rc and dereferencing netdev->name in pr_warn(). If dev_put() drops
> > the final reference to netdev, netdev->name accesses freed memory.
> >
> > Move dev_put(netdev) after the warning block so netdev is kept
> > alive while its name is read.
> >
> > Fixes: d41861942fc5 ("IB/core: Add generic function to extract IB speed from netdev")
> > Signed-off-by: Eric Dumazet <[email protected]>
> > ---
> >  drivers/infiniband/core/verbs.c | 4 ++--
> >  1 file changed, 2 insertions(+), 2 deletions(-)
>
> I was intending to take this patch next cycle:
>
> https://patchwork.kernel.org/project/linux-rdma/patch/[email protected]/

Ah... I missed that.

>
> Which has the same change embedded?

SGTM thanks.