[PATCH] RDMA/core: Fix use-after-free in ib_get_eth_speed()
Eric Dumazet <[email protected]>
| Newsgroups | org.kernel.vger.netdev,org.kernel.vger.linux-rdma |
|---|---|
| Message-ID | <[email protected]> |
In ib_get_eth_speed(), dev_put(netdev) is called before inspecting
rc and dereferencing netdev->name in pr_warn(). If dev_put() drops
the final reference to netdev, netdev->name accesses freed memory.
Move dev_put(netdev) after the warning block so netdev is kept
alive while its name is read.
Fixes: d41861942fc5 ("IB/core: Add generic function to extract IB speed from netdev")
Signed-off-by: Eric Dumazet <[email protected]>
---
drivers/infiniband/core/verbs.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c
index 86811d31092ce03c8156b444fece47b824231219..57f109c8085dadf90bcc498a9ee64eea3c5f5271 100644
--- a/drivers/infiniband/core/verbs.c
+++ b/drivers/infiniband/core/verbs.c
@@ -2052,8 +2052,6 @@ int ib_get_eth_speed(struct ib_device *dev, u32 port_num, u16 *speed, u8 *width)
rc = __ethtool_get_link_ksettings(netdev, &lksettings);
rtnl_unlock();
- dev_put(netdev);
-
if (!rc && lksettings.base.speed != (u32)SPEED_UNKNOWN) {
netdev_speed = lksettings.base.speed;
} else {
@@ -2063,6 +2061,8 @@ int ib_get_eth_speed(struct ib_device *dev, u32 port_num, u16 *speed, u8 *width)
netdev->name, netdev_speed);
}
+ dev_put(netdev);
+
ib_get_width_and_speed(netdev_speed, lksettings.lanes,
speed, width);
--
2.55.0.766.g2966f0265a-goog