Skip to content

Commit

Permalink
net/mlx5: Devcom, fix error flow in mlx5_devcom_register_device
Browse files Browse the repository at this point in the history
In case devcom allocation is failed, mlx5 is always freeing the priv.
However, this priv might have been allocated by a different thread,
and freeing it might lead to use-after-free bugs.
Fix it by freeing the priv only in case it was allocated by the
running thread.

Fixes: fadd59f ("net/mlx5: Introduce inter-device communication mechanism")
Signed-off-by: Shay Drory <shayd@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
  • Loading branch information
Shay Drory authored and Saeed Mahameed committed May 23, 2023
1 parent 8c253df commit af87194
Showing 1 changed file with 2 additions and 1 deletion.
3 changes: 2 additions & 1 deletion drivers/net/ethernet/mellanox/mlx5/core/lib/devcom.c
Original file line number Diff line number Diff line change
Expand Up @@ -112,7 +112,8 @@ struct mlx5_devcom *mlx5_devcom_register_device(struct mlx5_core_dev *dev)
priv->devs[idx] = dev;
devcom = mlx5_devcom_alloc(priv, idx);
if (!devcom) {
kfree(priv);
if (new_priv)
kfree(priv);
return ERR_PTR(-ENOMEM);
}

Expand Down

0 comments on commit af87194

Please sign in to comment.