[PATCH] RDMA/core: Fix use-after-free in ib_get_eth_speed()
From: Eric Dumazet <edumazet@google.com>
Date: 2026-08-21 07:05:15
Also in:
linux-rdma
Subsystem:
infiniband subsystem, the rest · Maintainers:
Jason Gunthorpe, Leon Romanovsky, Linus Torvalds
In ib_get_eth_speed(), dev_put(netdev) is called before inspecting
rc and dereferencing netdev->name in pr_warn(). If dev_put() drops
the final reference to netdev, netdev->name accesses freed memory.
Move dev_put(netdev) after the warning block so netdev is kept
alive while its name is read.
Fixes: d41861942fc5 ("IB/core: Add generic function to extract IB speed from netdev")
Signed-off-by: Eric Dumazet <edumazet@google.com>
---
drivers/infiniband/core/verbs.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c
index 86811d31092ce03c8156b444fece47b824231219..57f109c8085dadf90bcc498a9ee64eea3c5f5271 100644
--- a/drivers/infiniband/core/verbs.c
+++ b/drivers/infiniband/core/verbs.c@@ -2052,8 +2052,6 @@ int ib_get_eth_speed(struct ib_device *dev, u32 port_num, u16 *speed, u8 *width) rc = __ethtool_get_link_ksettings(netdev, &lksettings); rtnl_unlock(); - dev_put(netdev); - if (!rc && lksettings.base.speed != (u32)SPEED_UNKNOWN) { netdev_speed = lksettings.base.speed; } else {
@@ -2063,6 +2061,8 @@ int ib_get_eth_speed(struct ib_device *dev, u32 port_num, u16 *speed, u8 *width) netdev->name, netdev_speed); } + dev_put(netdev); + ib_get_width_and_speed(netdev_speed, lksettings.lanes, speed, width);
--
2.55.0.766.g2966f0265a-goog