RDMA/bnxt_re: Properly order ib_device_unalloc() to avoid UAF

selvintxavier · jgunthorpe · commit 5363fc488da5 · 2023-08-10T16:35:54.000-03:00
ib_dealloc_device() should be called only after device cleanup. Fix the dealloc sequence. Fixes: 6d75814 ("RDMA/bnxt_re: Use auxiliary driver interface") Link: https://lore.kernel.org/r/1691642677-21369-2-git-send-email-selvin.xavier@broadcom.com Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com> Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
diff --git a/drivers/infiniband/hw/bnxt_re/main.c b/drivers/infiniband/hw/bnxt_re/main.c
@@ -1526,8 +1526,8 @@ static void bnxt_re_remove(struct auxiliary_device *adev)
 	}
 	bnxt_re_setup_cc(rdev, false);
 	ib_unregister_device(&rdev->ibdev);
-	ib_dealloc_device(&rdev->ibdev);
 	bnxt_re_dev_uninit(rdev);
+	ib_dealloc_device(&rdev->ibdev);
 skip_remove:
 	mutex_unlock(&bnxt_re_mutex);
 }

Original file line number	Diff line number	Diff line change
`@@ -1526,8 +1526,8 @@ static void bnxt_re_remove(struct auxiliary_device *adev)`
`1526`	`1526`	`}`
`1527`	`1527`	`bnxt_re_setup_cc(rdev, false);`
`1528`	`1528`	`ib_unregister_device(&rdev->ibdev);`
`1529`		`- ib_dealloc_device(&rdev->ibdev);`
`1530`	`1529`	`bnxt_re_dev_uninit(rdev);`
	`1530`	`+ ib_dealloc_device(&rdev->ibdev);`
`1531`	`1531`	`skip_remove:`
`1532`	`1532`	`mutex_unlock(&bnxt_re_mutex);`
`1533`	`1533`	`}`