diff options
| author | Jacob Moroni <jmoroni@google.com> | 2026-02-27 15:27:43 +0000 |
|---|---|---|
| committer | Leon Romanovsky <leon@kernel.org> | 2026-03-04 02:44:01 -0500 |
| commit | 29a3edd7004bb635d299fb9bc6f0ea4ef13ed5a2 (patch) | |
| tree | 4cd4a1d1b1f157807fbb38c2f0405c485fbe1d89 /include/linux/tc_act/git@git.tavy.me:linux.git | |
| parent | 11439c4635edd669ae435eec308f4ab8a0804808 (diff) | |
RDMA/irdma: Fix double free related to rereg_user_mr
If IB_MR_REREG_TRANS is set during rereg_user_mr, the
umem will be released and a new one will be allocated
in irdma_rereg_mr_trans. If any step of irdma_rereg_mr_trans
fails after the new umem is allocated, it releases the umem,
but does not set iwmr->region to NULL. The problem is that
this failure is propagated to the user, who will then call
ibv_dereg_mr (as they should). Then, the dereg_mr path will
see a non-NULL umem and attempt to call ib_umem_release again.
Fix this by setting iwmr->region to NULL after ib_umem_release.
Fixed: 5ac388db27c4 ("RDMA/irdma: Add support to re-register a memory region")
Signed-off-by: Jacob Moroni <jmoroni@google.com>
Link: https://patch.msgid.link/20260227152743.1183388-1-jmoroni@google.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Diffstat (limited to 'include/linux/tc_act/git@git.tavy.me:linux.git')
0 files changed, 0 insertions, 0 deletions
