releases/5.0.14/ib-core-unregister-notifier-before-freeing-mad-security.patch

   1 From d60667fc398ed34b3c7456b020481c55c760e503 Mon Sep 17 00:00:00 2001
   2 From: Daniel Jurgens <danielj@mellanox.com>
   3 Date: Sat, 2 Feb 2019 11:09:42 +0200
   4 Subject: IB/core: Unregister notifier before freeing MAD security
   5
   6 From: Daniel Jurgens <danielj@mellanox.com>
   7
   8 commit d60667fc398ed34b3c7456b020481c55c760e503 upstream.
   9
  10 If the notifier runs after the security context is freed an access of
  11 freed memory can occur.
  12
  13 Fixes: 47a2b338fe63 ("IB/core: Enforce security on management datagrams")
  14 Signed-off-by: Daniel Jurgens <danielj@mellanox.com>
  15 Reviewed-by: Parav Pandit <parav@mellanox.com>
  16 Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
  17 Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
  18 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  19
  20 ---
  21  drivers/infiniband/core/security.c |    3 ++-
  22  1 file changed, 2 insertions(+), 1 deletion(-)
  23
  24 --- a/drivers/infiniband/core/security.c
  25 +++ b/drivers/infiniband/core/security.c
  26 @@ -727,9 +727,10 @@ void ib_mad_agent_security_cleanup(struc
  27         if (!rdma_protocol_ib(agent->device, agent->port_num))
  28                 return;
  29
  30 -       security_ib_free_security(agent->security);
  31         if (agent->lsm_nb_reg)
  32                 unregister_lsm_notifier(&agent->lsm_nb);
  33 +
  34 +       security_ib_free_security(agent->security);
  35  }
  36
  37  int ib_mad_enforce_security(struct ib_mad_agent_private *map, u16 pkey_index)