* [PATCH] mlxsw: spectrum_router: Fix use after free
@ 2016-08-14 13:38 Vincent Stehlé
2016-08-14 15:49 ` Ido Schimmel
2016-08-15 4:33 ` David Miller
0 siblings, 2 replies; 3+ messages in thread
From: Vincent Stehlé @ 2016-08-14 13:38 UTC (permalink / raw)
To: netdev; +Cc: linux-kernel, Vincent Stehlé, Jiri Pirko
In mlxsw_sp_router_fib4_add_info_destroy(), the fib_entry pointer is used
after it has been freed by mlxsw_sp_fib_entry_destroy(). Use a temporary
variable to fix this.
Fixes: 61c503f976b5449e ("mlxsw: spectrum_router: Implement fib4 add/del switchdev obj ops")
Signed-off-by: Vincent Stehlé <vincent.stehle@laposte.net>
Cc: Jiri Pirko <jiri@mellanox.com>
---
drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
index 81418d6..90bb93b 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
@@ -1651,9 +1651,10 @@ static void mlxsw_sp_router_fib4_add_info_destroy(void const *data)
const struct mlxsw_sp_router_fib4_add_info *info = data;
struct mlxsw_sp_fib_entry *fib_entry = info->fib_entry;
struct mlxsw_sp *mlxsw_sp = info->mlxsw_sp;
+ struct mlxsw_sp_vr *vr = fib_entry->vr;
mlxsw_sp_fib_entry_destroy(fib_entry);
- mlxsw_sp_vr_put(mlxsw_sp, fib_entry->vr);
+ mlxsw_sp_vr_put(mlxsw_sp, vr);
kfree(info);
}
--
2.8.1
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH] mlxsw: spectrum_router: Fix use after free
2016-08-14 13:38 [PATCH] mlxsw: spectrum_router: Fix use after free Vincent Stehlé
@ 2016-08-14 15:49 ` Ido Schimmel
2016-08-15 4:33 ` David Miller
1 sibling, 0 replies; 3+ messages in thread
From: Ido Schimmel @ 2016-08-14 15:49 UTC (permalink / raw)
To: Vincent Stehlé; +Cc: netdev, linux-kernel, Jiri Pirko
On Sun, Aug 14, 2016 at 03:38:29PM +0200, Vincent Stehlé wrote:
> In mlxsw_sp_router_fib4_add_info_destroy(), the fib_entry pointer is used
> after it has been freed by mlxsw_sp_fib_entry_destroy(). Use a temporary
> variable to fix this.
>
> Fixes: 61c503f976b5449e ("mlxsw: spectrum_router: Implement fib4 add/del switchdev obj ops")
> Signed-off-by: Vincent Stehlé <vincent.stehle@laposte.net>
> Cc: Jiri Pirko <jiri@mellanox.com>
Acked-by: Ido Schimmel <idosch@mellanox.com>
Thank you.
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH] mlxsw: spectrum_router: Fix use after free
2016-08-14 13:38 [PATCH] mlxsw: spectrum_router: Fix use after free Vincent Stehlé
2016-08-14 15:49 ` Ido Schimmel
@ 2016-08-15 4:33 ` David Miller
1 sibling, 0 replies; 3+ messages in thread
From: David Miller @ 2016-08-15 4:33 UTC (permalink / raw)
To: vincent.stehle; +Cc: netdev, linux-kernel, jiri
From: Vincent Stehlé <vincent.stehle@laposte.net>
Date: Sun, 14 Aug 2016 15:38:29 +0200
> In mlxsw_sp_router_fib4_add_info_destroy(), the fib_entry pointer is used
> after it has been freed by mlxsw_sp_fib_entry_destroy(). Use a temporary
> variable to fix this.
>
> Fixes: 61c503f976b5449e ("mlxsw: spectrum_router: Implement fib4 add/del switchdev obj ops")
> Signed-off-by: Vincent Stehlé <vincent.stehle@laposte.net>
> Cc: Jiri Pirko <jiri@mellanox.com>
Applied.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2016-08-15 4:33 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-08-14 13:38 [PATCH] mlxsw: spectrum_router: Fix use after free Vincent Stehlé
2016-08-14 15:49 ` Ido Schimmel
2016-08-15 4:33 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).