p71924506
/
linux_old1
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

net/mlx5e: IPoIB, Fix access to invalid memory address 

When cleaning rdma netdevice we need to save the mdev pointer
because priv is released when we release netdev.

This bug was found using the kernel address sanitizer (KASAN).
use-after-free in mlx5_rdma_netdev_free+0xe3/0x100 [mlx5_core]

Fixes: 48935bbb7a ("net/mlx5e: IPoIB, Add netdevice profile skeleton")
Signed-off-by: Roi Dayan <roid@mellanox.com>
Reviewed-by: Or Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
This commit is contained in:
Roi Dayan 2017-08-21 12:04:50 +03:00 committed by Saeed Mahameed
parent c2cc187e53
commit 38e8a5c040
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c
View File

@ -572,12 +572,13 @@ void mlx5_rdma_netdev_free(struct net_device *netdev)
{ {
struct mlx5e_priv *priv = mlx5i_epriv(netdev); struct mlx5e_priv *priv = mlx5i_epriv(netdev);
const struct mlx5e_profile *profile = priv->profile; const struct mlx5e_profile *profile = priv->profile;
struct mlx5_core_dev *mdev = priv->mdev;
mlx5e_detach_netdev(priv); mlx5e_detach_netdev(priv);
profile->cleanup(priv); profile->cleanup(priv);
destroy_workqueue(priv->wq); destroy_workqueue(priv->wq);
free_netdev(netdev); free_netdev(netdev);
mlx5e_destroy_mdev_resources(priv->mdev); mlx5e_destroy_mdev_resources(mdev);
} }
EXPORT_SYMBOL(mlx5_rdma_netdev_free); EXPORT_SYMBOL(mlx5_rdma_netdev_free);