[PATCH] RDMA/core: Fix use-after-free in ib_get_eth_speed()

[PATCH] RDMA/core: Fix use-after-free in ib_get_eth_speed()

[Eric Dumazet]

In ib_get_eth_speed(), dev_put(netdev) is called before inspecting
rc and dereferencing netdev->name in pr_warn(). If dev_put() drops
the final reference to netdev, netdev->name accesses freed memory.

Move dev_put(netdev) after the warning block so netdev is kept
alive while its name is read.

Fixes: d41861942fc5 ("IB/core: Add generic function to extract IB speed from netdev")
Signed-off-by: Eric Dumazet <edumazet@google.com>
---
 drivers/infiniband/core/verbs.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c
index 86811d31092ce03c8156b444fece47b824231219..57f109c8085dadf90bcc498a9ee64eea3c5f5271 100644
--- a/drivers/infiniband/core/verbs.c
+++ b/drivers/infiniband/core/verbs.c
@@ -2052,8 +2052,6 @@ int ib_get_eth_speed(struct ib_device *dev, u32 port_num, u16 *speed, u8 *width)
 	rc = __ethtool_get_link_ksettings(netdev, &lksettings);
 	rtnl_unlock();
 
-	dev_put(netdev);
-
 	if (!rc && lksettings.base.speed != (u32)SPEED_UNKNOWN) {
 		netdev_speed = lksettings.base.speed;
 	} else {
@@ -2063,6 +2061,8 @@ int ib_get_eth_speed(struct ib_device *dev, u32 port_num, u16 *speed, u8 *width)
 				netdev->name, netdev_speed);
 	}
 
+	dev_put(netdev);
+
 	ib_get_width_and_speed(netdev_speed, lksettings.lanes,
 			       speed, width);
 
-- 
2.55.0.766.g2966f0265a-goog

Re: [PATCH] RDMA/core: Fix use-after-free in ib_get_eth_speed()

[Kalesh Anakkur Purayil]

[-- Attachment #1: Type: text/plain, Size: 630 bytes --]

On Fri, Aug 21, 2026 at 12:37 PM Eric Dumazet <edumazet@google.com> wrote:
>
> In ib_get_eth_speed(), dev_put(netdev) is called before inspecting
> rc and dereferencing netdev->name in pr_warn(). If dev_put() drops
> the final reference to netdev, netdev->name accesses freed memory.
>
> Move dev_put(netdev) after the warning block so netdev is kept
> alive while its name is read.
>
> Fixes: d41861942fc5 ("IB/core: Add generic function to extract IB speed from netdev")
> Signed-off-by: Eric Dumazet <edumazet@google.com>

Reviewed-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>

-- 
Regards,
Kalesh AP

[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 5509 bytes --]

Re: [PATCH] RDMA/core: Fix use-after-free in ib_get_eth_speed()

[Jason Gunthorpe]

On Fri, Aug 21, 2026 at 07:05:12AM +0000, Eric Dumazet wrote:
> In ib_get_eth_speed(), dev_put(netdev) is called before inspecting
> rc and dereferencing netdev->name in pr_warn(). If dev_put() drops
> the final reference to netdev, netdev->name accesses freed memory.
> 
> Move dev_put(netdev) after the warning block so netdev is kept
> alive while its name is read.
> 
> Fixes: d41861942fc5 ("IB/core: Add generic function to extract IB speed from netdev")
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> ---
>  drivers/infiniband/core/verbs.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)

I was intending to take this patch next cycle:

https://patchwork.kernel.org/project/linux-rdma/patch/20260812081708.32468-1-krystianmkaniewski@gmail.com/

Which has the same change embedded?

Jason

Re: [PATCH] RDMA/core: Fix use-after-free in ib_get_eth_speed()

[Eric Dumazet]

On Fri, Aug 21, 2026 at 3:26 PM Jason Gunthorpe <jgg@ziepe.ca> wrote:
>
> On Fri, Aug 21, 2026 at 07:05:12AM +0000, Eric Dumazet wrote:
> > In ib_get_eth_speed(), dev_put(netdev) is called before inspecting
> > rc and dereferencing netdev->name in pr_warn(). If dev_put() drops
> > the final reference to netdev, netdev->name accesses freed memory.
> >
> > Move dev_put(netdev) after the warning block so netdev is kept
> > alive while its name is read.
> >
> > Fixes: d41861942fc5 ("IB/core: Add generic function to extract IB speed from netdev")
> > Signed-off-by: Eric Dumazet <edumazet@google.com>
> > ---
> >  drivers/infiniband/core/verbs.c | 4 ++--
> >  1 file changed, 2 insertions(+), 2 deletions(-)
>
> I was intending to take this patch next cycle:
>
> https://patchwork.kernel.org/project/linux-rdma/patch/20260812081708.32468-1-krystianmkaniewski@gmail.com/

Ah... I missed that.

>
> Which has the same change embedded?

SGTM thanks.