Bart Van Assche d0d9888d71 IB/umad: Fix use-after-free on close ... commit 60e1751cb5 upstream. Avoid that closing /dev/infiniband/umad<n> or /dev/infiniband/issm<n> triggers a use-after-free. __fput() invokes f_op->release() before it invokes cdev_put(). Make sure that the ib_umad_device structure is freed by the cdev_put() call instead of f_op->release(). This avoids that changing the port mode from IB into Ethernet and back to IB followed by restarting opensmd triggers the following kernel oops: general protection fault: 0000 [#1] PREEMPT SMP RIP: 0010:[<ffffffff810cc65c>] [<ffffffff810cc65c>] module_put+0x2c/0x170 Call Trace: [<ffffffff81190f20>] cdev_put+0x20/0x30 [<ffffffff8118e2ce>] __fput+0x1ae/0x1f0 [<ffffffff8118e35e>] ____fput+0xe/0x10 [<ffffffff810723bc>] task_work_run+0xac/0xe0 [<ffffffff81002a9f>] do_notify_resume+0x9f/0xc0 [<ffffffff814b8398>] int_signal+0x12/0x17 Reference: https://bugzilla.kernel.org/show_bug.cgi?id=75051 Signed-off-by: Bart Van Assche <bvanassche@acm.org> Reviewed-by: Yann Droneaud <ydroneaud@opteya.com> Signed-off-by: Roland Dreier <roland@purestorage.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2014-07-06 18:49:19 -07:00
..
core	IB/umad: Fix use-after-free on close	2014-07-06 18:49:19 -07:00
hw	IB/ipath: Translate legacy diagpkt into newer extended diagpkt	2014-07-06 18:49:19 -07:00
ulp	IB/srp: Fix a sporadic crash triggered by cable pulling	2014-07-06 18:49:19 -07:00
Kconfig	ib_srpt: Initial SRP Target merge for v3.3-rc1	2011-12-16 06:33:56 +00:00
Makefile	ib_srpt: Initial SRP Target merge for v3.3-rc1	2011-12-16 06:33:56 +00:00