[OLK-6.6] RDMA/hns: Fix some mutex UAF

From: wenglianfa <wenglianfa@huawei.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IA5Z6R ---------------------------------------------------------------------- umem_unfree_list_mutex and mtr_unfree_list_mutex may be used after being destroyed. To fix it, The mutex is destroyed after it is used for the last time. Fixes: a91843046b2a ("RDMA/hns: Fix sleeping in spin_lock critical section") Signed-off-by: wenglianfa <wenglianfa@huawei.com> Signed-off-by: Guofeng Yue <yueguofeng@h-partners.com> --- drivers/infiniband/hw/hns/hns_roce_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/infiniband/hw/hns/hns_roce_main.c b/drivers/infiniband/hw/hns/hns_roce_main.c index 424dcf69d3b8..3628dbb250ab 100644 --- a/drivers/infiniband/hw/hns/hns_roce_main.c +++ b/drivers/infiniband/hw/hns/hns_roce_main.c @@ -1503,9 +1503,9 @@ void hns_roce_exit(struct hns_roce_dev *hr_dev, bool bond_cleanup) if (hr_dev->hw->hw_exit) hr_dev->hw->hw_exit(hr_dev); - hns_roce_teardown_hca(hr_dev); hns_roce_free_unfree_umem(hr_dev); hns_roce_free_unfree_mtr(hr_dev); + hns_roce_teardown_hca(hr_dev); hns_roce_cleanup_hem(hr_dev); if (hr_dev->cmd_mod) -- 2.33.0
participants (1)
-
Chengchang Tang