RDMA/ucma: Fix use-after-free access in ucma_close
The error in ucma_create_id() left ctx in the list of contexts belong to ucma file descriptor. The attempt to close this file descriptor causes to use-after-free accesses while iterating over such list. Fixes: 75216638 ("RDMA/cma: Export rdma cm interface to userspace") Reported-by:<syzbot+dcfd344365a56fbebd0f@syzkaller.appspotmail.com> Signed-off-by:
Leon Romanovsky <leonro@mellanox.com> Reviewed-by:
Sean Hefty <sean.hefty@intel.com> Signed-off-by:
Jason Gunthorpe <jgg@mellanox.com>
parent
2975d5de
Please register or sign in to comment