lkml.org 
[lkml]   [2021]   [May]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.11 580/601] RDMA/bnxt_re: Fix a double free in bnxt_qplib_alloc_res
    Date
    From: Lv Yunlong <lyl2019@mail.ustc.edu.cn>

    [ Upstream commit 34b39efa5ae82fc0ad0acc27653c12a56328dbbe ]

    In bnxt_qplib_alloc_res, it calls bnxt_qplib_alloc_dpi_tbl(). Inside
    bnxt_qplib_alloc_dpi_tbl, dpit->dbr_bar_reg_iomem is freed via
    pci_iounmap() in unmap_io error branch. After the callee returns err code,
    bnxt_qplib_alloc_res calls
    bnxt_qplib_free_res()->bnxt_qplib_free_dpi_tbl() in the fail branch. Then
    dpit->dbr_bar_reg_iomem is freed in the second time by pci_iounmap().

    My patch set dpit->dbr_bar_reg_iomem to NULL after it is freed by
    pci_iounmap() in the first time, to avoid the double free.

    Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver")
    Link: https://lore.kernel.org/r/20210426140614.6722-1-lyl2019@mail.ustc.edu.cn
    Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
    Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
    Acked-by: Devesh Sharma <devesh.sharma@broadcom.com>
    Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/infiniband/hw/bnxt_re/qplib_res.c | 1 +
    1 file changed, 1 insertion(+)

    diff --git a/drivers/infiniband/hw/bnxt_re/qplib_res.c b/drivers/infiniband/hw/bnxt_re/qplib_res.c
    index fa7878336100..3ca47004b752 100644
    --- a/drivers/infiniband/hw/bnxt_re/qplib_res.c
    +++ b/drivers/infiniband/hw/bnxt_re/qplib_res.c
    @@ -854,6 +854,7 @@ static int bnxt_qplib_alloc_dpi_tbl(struct bnxt_qplib_res *res,

    unmap_io:
    pci_iounmap(res->pdev, dpit->dbr_bar_reg_iomem);
    + dpit->dbr_bar_reg_iomem = NULL;
    return -ENOMEM;
    }

    --
    2.30.2


    \
     
     \ /
      Last update: 2021-05-12 19:58    [W:2.102 / U:0.020 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site