RDMA/restrack: Increment CQ restrack object before committing
authorLeon Romanovsky <leonro@mellanox.com>
Wed, 14 Feb 2018 10:35:37 +0000 (12:35 +0200)
committerJason Gunthorpe <jgg@mellanox.com>
Thu, 15 Feb 2018 22:31:26 +0000 (15:31 -0700)
commit0cba0efcc7238d47a045a8d7a4079f6a22993546
treee35803a9f95ff2fc2f9188ab0f140819a878c1cc
parent3f802b162dbf4a558ff98986449eddc717826209
RDMA/restrack: Increment CQ restrack object before committing

Once the uobj is committed it is immediately possible another thread
could destroy it, which worst case, can result in a use-after-free
of the restrack objects.

Cc: syzkaller <syzkaller@googlegroups.com>
Fixes: 08f294a1524b ("RDMA/core: Add resource tracking for create and destroy CQs")
Reported-by: Noa Osherovich <noaos@mellanox.com>
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
drivers/infiniband/core/uverbs_cmd.c