diff options
| author | Shay Drory <shayd@nvidia.com> | 2023-05-02 13:35:11 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2023-05-30 12:57:59 +0100 |
| commit | d4d10a6df1529b3f446cdada5c25e065f4712756 (patch) | |
| tree | 3b44584d80d310ed5d95ceb2f267d9cdbde06855 | |
| parent | 8b9c561b9fc186a623982eb9fdd5fa58e48ccf47 (diff) | |
| download | linux-stable-d4d10a6df1529b3f446cdada5c25e065f4712756.tar.gz linux-stable-d4d10a6df1529b3f446cdada5c25e065f4712756.tar.bz2 linux-stable-d4d10a6df1529b3f446cdada5c25e065f4712756.zip | |
net/mlx5: Devcom, fix error flow in mlx5_devcom_register_device
commit af87194352cad882d787d06fb7efa714acd95427 upstream.
In case devcom allocation is failed, mlx5 is always freeing the priv.
However, this priv might have been allocated by a different thread,
and freeing it might lead to use-after-free bugs.
Fix it by freeing the priv only in case it was allocated by the
running thread.
Fixes: fadd59fc50d0 ("net/mlx5: Introduce inter-device communication mechanism")
Signed-off-by: Shay Drory <shayd@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/net/ethernet/mellanox/mlx5/core/lib/devcom.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/devcom.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/devcom.c index bced2efe9bef..abd066e95228 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/lib/devcom.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/devcom.c @@ -110,7 +110,8 @@ struct mlx5_devcom *mlx5_devcom_register_device(struct mlx5_core_dev *dev) priv->devs[idx] = dev; devcom = mlx5_devcom_alloc(priv, idx); if (!devcom) { - kfree(priv); + if (new_priv) + kfree(priv); return ERR_PTR(-ENOMEM); } |