Skip to content

Commit

Permalink
net/mlx5: Devcom, fix error flow in mlx5_devcom_register_device
Browse files Browse the repository at this point in the history
commit af87194 upstream.

In case devcom allocation is failed, mlx5 is always freeing the priv.
However, this priv might have been allocated by a different thread,
and freeing it might lead to use-after-free bugs.
Fix it by freeing the priv only in case it was allocated by the
running thread.

Fixes: fadd59f ("net/mlx5: Introduce inter-device communication mechanism")
Signed-off-by: Shay Drory <shayd@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  • Loading branch information
Shay Drory authored and Greg Kroah-Hartman committed May 30, 2023
1 parent a89a69c commit 1e75506
Showing 1 changed file with 2 additions and 1 deletion.
3 changes: 2 additions & 1 deletion drivers/net/ethernet/mellanox/mlx5/core/lib/devcom.c
Original file line number Diff line number Diff line change
Expand Up @@ -110,7 +110,8 @@ struct mlx5_devcom *mlx5_devcom_register_device(struct mlx5_core_dev *dev)
priv->devs[idx] = dev;
devcom = mlx5_devcom_alloc(priv, idx);
if (!devcom) {
kfree(priv);
if (new_priv)
kfree(priv);
return ERR_PTR(-ENOMEM);
}

Expand Down

0 comments on commit 1e75506

Please sign in to comment.