[PATCH 2/5] RDMA/core: Fix netdev use-after-free in ib_get_eth_speed()

[PATCH 2/5] RDMA/core: Fix netdev use-after-free in ib_get_eth_speed()

[Wentao Liang]

The device reference is dropped before netdev->name is read in the
warning emitted when __ethtool_get_link_ksettings() fails.  If that was
the last reference the name is read from a freed netdev.

Move dev_put() below the last use of netdev.

Fixes: d41861942fc5 ("IB/core: Add generic function to extract IB speed from netdev")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/infiniband/core/verbs.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c
index bac87de9cc67..f11ac039e085 100644
--- a/drivers/infiniband/core/verbs.c
+++ b/drivers/infiniband/core/verbs.c
@@ -2055,8 +2055,6 @@ int ib_get_eth_speed(struct ib_device *dev, u32 port_num, u16 *speed, u8 *width)
 	rc = __ethtool_get_link_ksettings(netdev, &lksettings);
 	rtnl_unlock();
 
-	dev_put(netdev);
-
 	if (!rc && lksettings.base.speed != (u32)SPEED_UNKNOWN) {
 		netdev_speed = lksettings.base.speed;
 	} else {
@@ -2066,6 +2064,8 @@ int ib_get_eth_speed(struct ib_device *dev, u32 port_num, u16 *speed, u8 *width)
 				netdev->name, netdev_speed);
 	}
 
+	dev_put(netdev);
+
 	ib_get_width_and_speed(netdev_speed, lksettings.lanes,
 			       speed, width);
 
-- 
2.34.1

Re: [PATCH 2/5] RDMA/core: Fix netdev use-after-free in ib_get_eth_speed()

[Leon Romanovsky]

On Wed, Sep 16, 2026 at 06:33:06PM +0000, Wentao Liang wrote:
> The device reference is dropped before netdev->name is read in the
> warning emitted when __ethtool_get_link_ksettings() fails.  If that was
> the last reference the name is read from a freed netdev.
> 
> Move dev_put() below the last use of netdev.
> 
> Fixes: d41861942fc5 ("IB/core: Add generic function to extract IB speed from netdev")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/infiniband/core/verbs.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)

We already accepted this patch
https://patchwork.kernel.org/project/linux-rdma/patch/20260812081708.32468-1-krystianmkaniewski@gmail.com/

Thanks