redonkable
/
alistair23-linux
1
0
Fork 0
Code Releases Activity

mlx4: Fixing use after free 

In case of allocation failure, tried to use the promiscuous QP
entry that was previously freed.
Now freeing this entry only in case we will not put it back to the list
of promiscuous entries.

Reported-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Yevgeny Petrilin <yevgenyp@mellanox.co.il>
Signed-off-by: David S. Miller <davem@davemloft.net>
hifive-unleashed-5.1
Yevgeny Petrilin 2011-03-30 23:28:52 +00:00 committed by David S. Miller
parent 5e8996e728
commit 53020092bd
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
drivers/net/mlx4/mcg.c
View File

@ -469,7 +469,6 @@ static int remove_promisc_qp(struct mlx4_dev *dev, u8 vep_num, u8 port,
/*remove from list of promisc qps */
list_del(&pqp->list);
kfree(pqp);
/* set the default entry not to include the removed one */
mailbox = mlx4_alloc_cmd_mailbox(dev);
@ -528,6 +527,8 @@ out_mailbox:
out_list:
if (back_to_list)
list_add_tail(&pqp->list, &s_steer->promisc_qps[steer]);
else
kfree(pqp);
out_mutex:
mutex_unlock(&priv->mcg_table.mutex);
return err;