* [PATCH] mlx4: Fixing use after free
@ 2011-03-31 9:28 Yevgeny Petrilin
2011-03-31 9:52 ` David Miller
0 siblings, 1 reply; 2+ messages in thread
From: Yevgeny Petrilin @ 2011-03-31 9:28 UTC (permalink / raw)
To: davem; +Cc: netdev, yevgenyp, error27
In case of allocation failure, tried to use the promiscuous QP
entry that was previously freed.
Now freeing this entry only in case we will not put it back to the list
of promiscuous entries.
Reported-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Yevgeny Petrilin <yevgenyp@mellanox.co.il>
---
drivers/net/mlx4/mcg.c | 3 ++-
1 files changed, 2 insertions(+), 1 deletions(-)
diff --git a/drivers/net/mlx4/mcg.c b/drivers/net/mlx4/mcg.c
index e71372a..37150b2 100644
--- a/drivers/net/mlx4/mcg.c
+++ b/drivers/net/mlx4/mcg.c
@@ -469,7 +469,6 @@ static int remove_promisc_qp(struct mlx4_dev *dev, u8 vep_num, u8 port,
/*remove from list of promisc qps */
list_del(&pqp->list);
- kfree(pqp);
/* set the default entry not to include the removed one */
mailbox = mlx4_alloc_cmd_mailbox(dev);
@@ -528,6 +527,8 @@ out_mailbox:
out_list:
if (back_to_list)
list_add_tail(&pqp->list, &s_steer->promisc_qps[steer]);
+ else
+ kfree(pqp);
out_mutex:
mutex_unlock(&priv->mcg_table.mutex);
return err;
--
1.6.0.2
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] mlx4: Fixing use after free
2011-03-31 9:28 [PATCH] mlx4: Fixing use after free Yevgeny Petrilin
@ 2011-03-31 9:52 ` David Miller
0 siblings, 0 replies; 2+ messages in thread
From: David Miller @ 2011-03-31 9:52 UTC (permalink / raw)
To: yevgenyp; +Cc: netdev, error27
From: Yevgeny Petrilin <yevgenyp@mellanox.co.il>
Date: Thu, 31 Mar 2011 11:28:52 +0200
>
> In case of allocation failure, tried to use the promiscuous QP
> entry that was previously freed.
> Now freeing this entry only in case we will not put it back to the list
> of promiscuous entries.
>
> Reported-by: Dan Carpenter <error27@gmail.com>
> Signed-off-by: Yevgeny Petrilin <yevgenyp@mellanox.co.il>
Applied.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2011-03-31 9:53 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2011-03-31 9:28 [PATCH] mlx4: Fixing use after free Yevgeny Petrilin
2011-03-31 9:52 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).