diff options
| author | Shay Drory <shayd@nvidia.com> | 2023-05-02 13:35:11 +0300 |
|---|---|---|
| committer | Saeed Mahameed <saeedm@nvidia.com> | 2023-05-22 22:38:06 -0700 |
| commit | af87194352cad882d787d06fb7efa714acd95427 (patch) | |
| tree | 93351bcccc4da2bfb6d895e39a62b9aaf0f09890 | |
| parent | 8c253dfc89efde6b5faddf9e7400e5d17884e042 (diff) | |
| download | linux-af87194352cad882d787d06fb7efa714acd95427.tar.gz | |
net/mlx5: Devcom, fix error flow in mlx5_devcom_register_device
In case devcom allocation is failed, mlx5 is always freeing the priv.
However, this priv might have been allocated by a different thread,
and freeing it might lead to use-after-free bugs.
Fix it by freeing the priv only in case it was allocated by the
running thread.
Fixes: fadd59fc50d0 ("net/mlx5: Introduce inter-device communication mechanism")
Signed-off-by: Shay Drory <shayd@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
| -rw-r--r-- | drivers/net/ethernet/mellanox/mlx5/core/lib/devcom.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/devcom.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/devcom.c index 070d55f134196..8f978491dd32f 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/lib/devcom.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/devcom.c @@ -112,7 +112,8 @@ struct mlx5_devcom *mlx5_devcom_register_device(struct mlx5_core_dev *dev) priv->devs[idx] = dev; devcom = mlx5_devcom_alloc(priv, idx); if (!devcom) { - kfree(priv); + if (new_priv) + kfree(priv); return ERR_PTR(-ENOMEM); } |