From befcc1fce564bdb20ee55be981a355b0a7d0eac5 Mon Sep 17 00:00:00 2001 From: Edward Cree Date: Fri, 12 May 2023 16:35:58 +0100 Subject: [PATCH] sfc: fix use-after-free in efx_tc_flower_record_encap_match() When writing error messages to extack for pseudo collisions, we can't use encap->type as encap has already been freed. Fortunately the same value is stored in local variable em_type, so use that instead. Fixes: 3c9561c0a5b9 ("sfc: support TC decap rules matching on enc_ip_tos") Reported-by: Simon Horman Signed-off-by: Edward Cree Reviewed-by: Simon Horman Signed-off-by: David S. Miller --- drivers/net/ethernet/sfc/tc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/sfc/tc.c b/drivers/net/ethernet/sfc/tc.c index da684b4b7211..6dfbdb39f2fe 100644 --- a/drivers/net/ethernet/sfc/tc.c +++ b/drivers/net/ethernet/sfc/tc.c @@ -504,7 +504,7 @@ static int efx_tc_flower_record_encap_match(struct efx_nic *efx, if (em_type != EFX_TC_EM_PSEUDO_MASK) { NL_SET_ERR_MSG_FMT_MOD(extack, "%s encap match conflicts with existing pseudo(MASK) entry", - encap->type ? "Pseudo" : "Direct"); + em_type ? "Pseudo" : "Direct"); return -EEXIST; } if (child_ip_tos_mask != old->child_ip_tos_mask) { @@ -525,7 +525,7 @@ static int efx_tc_flower_record_encap_match(struct efx_nic *efx, default: /* Unrecognised pseudo-type. Just say no */ NL_SET_ERR_MSG_FMT_MOD(extack, "%s encap match conflicts with existing pseudo(%d) entry", - encap->type ? "Pseudo" : "Direct", + em_type ? "Pseudo" : "Direct", old->type); return -EEXIST; }