iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

net/mlx5: Fix UAF in mlx5_eswitch_cleanup()

Browse Source 
mlx5_eswitch_cleanup() is using esw right after freeing it for
releasing devlink_param.
Fix it by releasing the devlink_param before freeing the esw, and
adjust the create function accordingly.

Fixes: 3f90840305 ("net/mlx5: Move esw multiport devlink param to eswitch code")
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Shay Drory <shayd@nvidia.com>
Reviewed-by: Automatic Verification <verifier@nvidia.com>
Reviewed-by: Gal Pressman <gal@nvidia.com>
Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
This commit is contained in:
Shay Drory 2023-06-14 16:26:07 +03:00 committed by Saeed Mahameed
parent faaa5fd303
commit da744fd136
1 changed files with 8 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
View File

@ -1751,16 +1751,14 @@ int mlx5_eswitch_init(struct mlx5_core_dev *dev)
if (!MLX5_VPORT_MANAGER(dev) && !MLX5_ESWITCH_MANAGER(dev))
return 0;
esw = kzalloc(sizeof(*esw), GFP_KERNEL);
if (!esw)
return -ENOMEM;
err = devl_params_register(priv_to_devlink(dev), mlx5_eswitch_params,
ARRAY_SIZE(mlx5_eswitch_params));
if (err)
return err;
esw = kzalloc(sizeof(*esw), GFP_KERNEL);
if (!esw) {
err = -ENOMEM;
goto unregister_param;
}
goto free_esw;
esw->dev = dev;
esw->manager_vport = mlx5_eswitch_manager_vport(dev);
@ -1821,10 +1819,10 @@ abort:
if (esw->work_queue)
destroy_workqueue(esw->work_queue);
debugfs_remove_recursive(esw->debugfs_root);
kfree(esw);
unregister_param:
devl_params_unregister(priv_to_devlink(dev), mlx5_eswitch_params,
ARRAY_SIZE(mlx5_eswitch_params));
free_esw:
kfree(esw);
return err;
}
@ -1848,9 +1846,9 @@ void mlx5_eswitch_cleanup(struct mlx5_eswitch *esw)
esw_offloads_cleanup(esw);
mlx5_esw_vports_cleanup(esw);
debugfs_remove_recursive(esw->debugfs_root);
kfree(esw);
devl_params_unregister(priv_to_devlink(esw->dev), mlx5_eswitch_params,
ARRAY_SIZE(mlx5_eswitch_params));
kfree(esw);
}
/* Vport Administration */