From: saeed@kernel.org
To: "David S. Miller" <davem@davemloft.net>,
Jakub Kicinski <kuba@kernel.org>
Cc: netdev@vger.kernel.org, Dan Carpenter <dan.carpenter@oracle.com>,
Leon Romanovsky <leonro@nvidia.com>,
Saeed Mahameed <saeedm@nvidia.com>
Subject: [net-next 14/15] net/mlx5e: Fix a use after free on error in mlx5_tc_ct_shared_counter_get()
Date: Wed, 30 Sep 2020 21:33:01 -0700 [thread overview]
Message-ID: <20201001043302.48113-15-saeed@kernel.org> (raw)
In-Reply-To: <20201001043302.48113-1-saeed@kernel.org>
From: Dan Carpenter <dan.carpenter@oracle.com>
This code frees "shared_counter" and then dereferences on the next line
to get the error code.
Fixes: 1edae2335adf ("net/mlx5e: CT: Use the same counter for both directions")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
---
drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c
index b5f8ed30047b..cea2070af9af 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c
@@ -739,6 +739,7 @@ mlx5_tc_ct_shared_counter_get(struct mlx5_tc_ct_priv *ct_priv,
struct mlx5_core_dev *dev = ct_priv->dev;
struct mlx5_ct_entry *rev_entry;
__be16 tmp_port;
+ int ret;
/* get the reversed tuple */
tmp_port = rev_tuple.port.src;
@@ -778,8 +779,9 @@ mlx5_tc_ct_shared_counter_get(struct mlx5_tc_ct_priv *ct_priv,
shared_counter->counter = mlx5_fc_create(dev, true);
if (IS_ERR(shared_counter->counter)) {
ct_dbg("Failed to create counter for ct entry");
+ ret = PTR_ERR(shared_counter->counter);
kfree(shared_counter);
- return ERR_PTR(PTR_ERR(shared_counter->counter));
+ return ERR_PTR(ret);
}
refcount_set(&shared_counter->refcount, 1);
--
2.26.2
next prev parent reply other threads:[~2020-10-01 4:33 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-10-01 4:32 [pull request][net-next 00/15] mlx5 updates 2020-09-30 saeed
2020-10-01 4:32 ` [net-next 01/15] net/mlx5: DR, Replace the check for valid STE entry saeed
2020-10-01 4:32 ` [net-next 02/15] net/mlx5: DR, Remove unneeded check from source port builder saeed
2020-10-01 4:32 ` [net-next 03/15] net/mlx5: DR, Remove unneeded vlan check from L2 builder saeed
2020-10-01 4:32 ` [net-next 04/15] net/mlx5: DR, Remove unneeded local variable saeed
2020-10-01 4:32 ` [net-next 05/15] net/mlx5: DR, Call ste_builder directly with tag pointer saeed
2020-10-01 4:32 ` [net-next 06/15] net/mlx5: DR, Add support for rule creation with flow source hint saeed
2020-10-01 4:32 ` [net-next 07/15] net/mlx5: E-switch, Use PF num in metadata reg c0 saeed
2020-10-01 4:32 ` [net-next 08/15] net/mlx5: E-switch, Add helper to check egress ACL need saeed
2020-10-01 4:32 ` [net-next 09/15] net/mlx5: E-switch, Use helper function to load unload representor saeed
2020-10-01 4:32 ` [net-next 10/15] net/mlx5: E-switch, Move devlink eswitch ports closer to eswitch saeed
2020-10-01 4:32 ` [net-next 11/15] net/mlx5: E-Switch, Support flow source for local vport saeed
2020-10-01 4:32 ` [net-next 12/15] net/mlx5: Use dma device access helper saeed
2020-10-01 4:33 ` [net-next 13/15] net/mlx5: Fix dereference on pointer attr after null check saeed
2020-10-01 4:33 ` saeed [this message]
2020-10-01 4:33 ` [net-next 15/15] net/mlx5e: Fix potential null pointer dereference saeed
2020-10-01 19:26 ` [pull request][net-next 00/15] mlx5 updates 2020-09-30 David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201001043302.48113-15-saeed@kernel.org \
--to=saeed@kernel.org \
--cc=dan.carpenter@oracle.com \
--cc=davem@davemloft.net \
--cc=kuba@kernel.org \
--cc=leonro@nvidia.com \
--cc=netdev@vger.kernel.org \
--cc=saeedm@nvidia.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.