In ib_get_eth_speed(), dev_put(netdev) is called before inspecting rc and dereferencing netdev->name in pr_warn(). If dev_put() drops the final reference to netdev, netdev->name accesses freed memory. Move dev_put(netdev) after the warning block so netdev is kept alive while its name is read. Fixes: d41861942fc5 ("IB/core: Add generic function to extract IB speed from netdev") Signed-off-by: Eric Dumazet --- drivers/infiniband/core/verbs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c index 86811d31092ce03c8156b444fece47b824231219..57f109c8085dadf90bcc498a9ee64eea3c5f5271 100644 --- a/drivers/infiniband/core/verbs.c +++ b/drivers/infiniband/core/verbs.c @@ -2052,8 +2052,6 @@ int ib_get_eth_speed(struct ib_device *dev, u32 port_num, u16 *speed, u8 *width) rc = __ethtool_get_link_ksettings(netdev, &lksettings); rtnl_unlock(); - dev_put(netdev); - if (!rc && lksettings.base.speed != (u32)SPEED_UNKNOWN) { netdev_speed = lksettings.base.speed; } else { @@ -2063,6 +2061,8 @@ int ib_get_eth_speed(struct ib_device *dev, u32 port_num, u16 *speed, u8 *width) netdev->name, netdev_speed); } + dev_put(netdev); + ib_get_width_and_speed(netdev_speed, lksettings.lanes, speed, width); -- 2.55.0.766.g2966f0265a-goog