lkml.org 
[lkml]   [2021]   [Sep]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 5.13 209/219] net/mlx5: DR, fix a potential use-after-free bug
    Date
    From: Wentao_Liang <Wentao_Liang_g@163.com>

    [ Upstream commit 6cc64770fb386b10a64a1fe09328396de7bb5262 ]

    In line 849 (#1), "mlx5dr_htbl_put(cur_htbl);" drops the reference to
    cur_htbl and may cause cur_htbl to be freed.

    However, cur_htbl is subsequently used in the next line, which may result
    in an use-after-free bug.

    Fix this by calling mlx5dr_err() before the cur_htbl is put.

    Signed-off-by: Wentao_Liang <Wentao_Liang_g@163.com>
    Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/net/ethernet/mellanox/mlx5/core/steering/dr_rule.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_rule.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_rule.c
    index 43356fad53de..ffdfb5a94b14 100644
    --- a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_rule.c
    +++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_rule.c
    @@ -846,9 +846,9 @@ dr_rule_handle_ste_branch(struct mlx5dr_rule *rule,
    new_htbl = dr_rule_rehash(rule, nic_rule, cur_htbl,
    ste_location, send_ste_list);
    if (!new_htbl) {
    - mlx5dr_htbl_put(cur_htbl);
    mlx5dr_err(dmn, "Failed creating rehash table, htbl-log_size: %d\n",
    cur_htbl->chunk_size);
    + mlx5dr_htbl_put(cur_htbl);
    } else {
    cur_htbl = new_htbl;
    }
    --
    2.30.2
    \
     
     \ /
      Last update: 2021-09-09 14:34    [W:4.156 / U:0.736 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site