* [PATCH net-next] net/mlx5e: Fix a use after free on error in mlx5_tc_ct_shared_counter_get()
@ 2020-09-28 9:05 Dan Carpenter
2020-09-28 11:55 ` Leon Romanovsky
2020-09-28 19:29 ` David Miller
0 siblings, 2 replies; 4+ messages in thread
From: Dan Carpenter @ 2020-09-28 9:05 UTC (permalink / raw)
To: Saeed Mahameed
Cc: Leon Romanovsky, David S. Miller, Jakub Kicinski, Roi Dayan,
Oz Shlomo, Paul Blakey, Eli Britstein, Ariel Levkovich, netdev,
linux-rdma, kernel-janitors
This code frees "shared_counter" and then dereferences on the next line
to get the error code.
Fixes: 1edae2335adf ("net/mlx5e: CT: Use the same counter for both directions")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c
index b5f8ed30047b..cea2070af9af 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c
@@ -739,6 +739,7 @@ mlx5_tc_ct_shared_counter_get(struct mlx5_tc_ct_priv *ct_priv,
struct mlx5_core_dev *dev = ct_priv->dev;
struct mlx5_ct_entry *rev_entry;
__be16 tmp_port;
+ int ret;
/* get the reversed tuple */
tmp_port = rev_tuple.port.src;
@@ -778,8 +779,9 @@ mlx5_tc_ct_shared_counter_get(struct mlx5_tc_ct_priv *ct_priv,
shared_counter->counter = mlx5_fc_create(dev, true);
if (IS_ERR(shared_counter->counter)) {
ct_dbg("Failed to create counter for ct entry");
+ ret = PTR_ERR(shared_counter->counter);
kfree(shared_counter);
- return ERR_PTR(PTR_ERR(shared_counter->counter));
+ return ERR_PTR(ret);
}
refcount_set(&shared_counter->refcount, 1);
--
2.28.0
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH net-next] net/mlx5e: Fix a use after free on error in mlx5_tc_ct_shared_counter_get()
2020-09-28 9:05 [PATCH net-next] net/mlx5e: Fix a use after free on error in mlx5_tc_ct_shared_counter_get() Dan Carpenter
@ 2020-09-28 11:55 ` Leon Romanovsky
2020-09-28 19:29 ` David Miller
1 sibling, 0 replies; 4+ messages in thread
From: Leon Romanovsky @ 2020-09-28 11:55 UTC (permalink / raw)
To: Dan Carpenter
Cc: Saeed Mahameed, David S. Miller, Jakub Kicinski, Roi Dayan,
Oz Shlomo, Paul Blakey, Eli Britstein, Ariel Levkovich, netdev,
linux-rdma, kernel-janitors
On Mon, Sep 28, 2020 at 12:05:56PM +0300, Dan Carpenter wrote:
> This code frees "shared_counter" and then dereferences on the next line
> to get the error code.
>
> Fixes: 1edae2335adf ("net/mlx5e: CT: Use the same counter for both directions")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
> drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
Thanks,
Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH net-next] net/mlx5e: Fix a use after free on error in mlx5_tc_ct_shared_counter_get()
2020-09-28 9:05 [PATCH net-next] net/mlx5e: Fix a use after free on error in mlx5_tc_ct_shared_counter_get() Dan Carpenter
2020-09-28 11:55 ` Leon Romanovsky
@ 2020-09-28 19:29 ` David Miller
2020-09-28 23:21 ` Saeed Mahameed
1 sibling, 1 reply; 4+ messages in thread
From: David Miller @ 2020-09-28 19:29 UTC (permalink / raw)
To: dan.carpenter
Cc: saeedm, leon, kuba, roid, ozsh, paulb, elibr, lariel, netdev,
linux-rdma, kernel-janitors
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Mon, 28 Sep 2020 12:05:56 +0300
> This code frees "shared_counter" and then dereferences on the next line
> to get the error code.
>
> Fixes: 1edae2335adf ("net/mlx5e: CT: Use the same counter for both directions")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Saeed, I assume you will pick this up.
Thank you.
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH net-next] net/mlx5e: Fix a use after free on error in mlx5_tc_ct_shared_counter_get()
2020-09-28 19:29 ` David Miller
@ 2020-09-28 23:21 ` Saeed Mahameed
0 siblings, 0 replies; 4+ messages in thread
From: Saeed Mahameed @ 2020-09-28 23:21 UTC (permalink / raw)
To: David Miller, dan.carpenter
Cc: leon, kuba, roid, ozsh, paulb, elibr, lariel, netdev, linux-rdma,
kernel-janitors
On Mon, 2020-09-28 at 12:29 -0700, David Miller wrote:
> From: Dan Carpenter <dan.carpenter@oracle.com>
> Date: Mon, 28 Sep 2020 12:05:56 +0300
>
> > This code frees "shared_counter" and then dereferences on the next
> line
> > to get the error code.
> >
> > Fixes: 1edae2335adf ("net/mlx5e: CT: Use the same counter for both
> directions")
> > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
>
> Saeed, I assume you will pick this up.
>
> Thank you.
Applied to net-next-mlx5.
Thanks
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2020-09-28 23:21 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-09-28 9:05 [PATCH net-next] net/mlx5e: Fix a use after free on error in mlx5_tc_ct_shared_counter_get() Dan Carpenter
2020-09-28 11:55 ` Leon Romanovsky
2020-09-28 19:29 ` David Miller
2020-09-28 23:21 ` Saeed Mahameed
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).