From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Wentao_Liang <Wentao_Liang_g@163.com>,
Saeed Mahameed <saeedm@nvidia.com>,
Sasha Levin <sashal@kernel.org>,
netdev@vger.kernel.org, linux-rdma@vger.kernel.org
Subject: [PATCH AUTOSEL 5.10 166/176] net/mlx5: DR, fix a potential use-after-free bug
Date: Thu, 9 Sep 2021 07:51:08 -0400 [thread overview]
Message-ID: <20210909115118.146181-166-sashal@kernel.org> (raw)
In-Reply-To: <20210909115118.146181-1-sashal@kernel.org>
From: Wentao_Liang <Wentao_Liang_g@163.com>
[ Upstream commit 6cc64770fb386b10a64a1fe09328396de7bb5262 ]
In line 849 (#1), "mlx5dr_htbl_put(cur_htbl);" drops the reference to
cur_htbl and may cause cur_htbl to be freed.
However, cur_htbl is subsequently used in the next line, which may result
in an use-after-free bug.
Fix this by calling mlx5dr_err() before the cur_htbl is put.
Signed-off-by: Wentao_Liang <Wentao_Liang_g@163.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlx5/core/steering/dr_rule.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_rule.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_rule.c
index b3c9dc032026..478de5ded7c2 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_rule.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_rule.c
@@ -824,9 +824,9 @@ dr_rule_handle_ste_branch(struct mlx5dr_rule *rule,
new_htbl = dr_rule_rehash(rule, nic_rule, cur_htbl,
ste_location, send_ste_list);
if (!new_htbl) {
- mlx5dr_htbl_put(cur_htbl);
mlx5dr_err(dmn, "Failed creating rehash table, htbl-log_size: %d\n",
cur_htbl->chunk_size);
+ mlx5dr_htbl_put(cur_htbl);
} else {
cur_htbl = new_htbl;
}
--
2.30.2
next prev parent reply other threads:[~2021-09-09 12:45 UTC|newest]
Thread overview: 51+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20210909115118.146181-1-sashal@kernel.org>
2021-09-09 11:48 ` [PATCH AUTOSEL 5.10 005/176] libbpf: Fix reuse of pinned map on older kernel Sasha Levin
2021-09-09 11:48 ` [PATCH AUTOSEL 5.10 009/176] tipc: keep the skb in rcv queue until the whole data is read Sasha Levin
2021-09-09 11:48 ` [PATCH AUTOSEL 5.10 010/176] net: phy: Fix data type in DP83822 dp8382x_disable_wol() Sasha Levin
2021-09-09 11:48 ` [PATCH AUTOSEL 5.10 012/176] iavf: do not override the adapter state in the watchdog task Sasha Levin
2021-09-09 11:48 ` [PATCH AUTOSEL 5.10 013/176] iavf: fix locking of critical sections Sasha Levin
2021-09-09 11:48 ` [PATCH AUTOSEL 5.10 016/176] netlink: Deal with ESRCH error in nlmsg_notify() Sasha Levin
2021-09-09 11:48 ` [PATCH AUTOSEL 5.10 022/176] igc: Check if num of q_vectors is smaller than max before array access Sasha Levin
2021-09-09 11:48 ` [PATCH AUTOSEL 5.10 037/176] nfp: fix return statement in nfp_net_parse_meta() Sasha Levin
2021-09-09 11:49 ` [PATCH AUTOSEL 5.10 039/176] ethtool: improve compat ioctl handling Sasha Levin
2021-09-09 11:49 ` [PATCH AUTOSEL 5.10 042/176] bpf/tests: Fix copy-and-paste error in double word test Sasha Levin
2021-09-09 11:49 ` [PATCH AUTOSEL 5.10 043/176] bpf/tests: Do not PASS tests without actually testing the result Sasha Levin
2021-09-09 11:49 ` [PATCH AUTOSEL 5.10 049/176] ipv4: ip_output.c: Fix out-of-bounds warning in ip_copy_addrs() Sasha Levin
2021-09-09 11:49 ` [PATCH AUTOSEL 5.10 050/176] flow_dissector: Fix out-of-bounds warnings Sasha Levin
2021-09-09 11:49 ` [PATCH AUTOSEL 5.10 058/176] samples: bpf: Fix tracex7 error raised on the missing argument Sasha Levin
2021-09-09 11:49 ` [PATCH AUTOSEL 5.10 059/176] libbpf: Fix race when pinning maps in parallel Sasha Levin
2021-09-09 11:49 ` [PATCH AUTOSEL 5.10 062/176] Bluetooth: skip invalid hci_sync_conn_complete_evt Sasha Levin
2021-09-09 11:49 ` [PATCH AUTOSEL 5.10 067/176] bonding: 3ad: fix the concurrency between __bond_release_one() and bond_3ad_state_machine_handler() Sasha Levin
2021-09-09 11:49 ` [PATCH AUTOSEL 5.10 071/176] bpf: Fix off-by-one in tail call count limiting Sasha Levin
2021-09-09 11:49 ` [PATCH AUTOSEL 5.10 091/176] net: ethernet: stmmac: Do not use unreachable() in ipq806x_gmac_probe() Sasha Levin
2021-09-09 11:50 ` [PATCH AUTOSEL 5.10 099/176] selftests/bpf: Fix xdp_tx.c prog section name Sasha Levin
2021-09-09 11:50 ` [PATCH AUTOSEL 5.10 101/176] Bluetooth: schedule SCO timeouts with delayed_work Sasha Levin
2021-09-09 11:50 ` [PATCH AUTOSEL 5.10 102/176] Bluetooth: avoid circular locks in sco_sock_connect Sasha Levin
2021-09-09 11:50 ` [PATCH AUTOSEL 5.10 104/176] net/mlx5: Fix variable type to match 64bit Sasha Levin
2021-09-09 11:50 ` [PATCH AUTOSEL 5.10 107/176] mac80211: Fix monitor MTU limit so that A-MSDUs get through Sasha Levin
2021-09-09 11:50 ` [PATCH AUTOSEL 5.10 115/176] Bluetooth: Fix handling of LE Enhanced Connection Complete Sasha Levin
2021-09-09 11:50 ` [PATCH AUTOSEL 5.10 119/176] tcp: enable data-less, empty-cookie SYN with TFO_SERVER_COOKIE_NOT_REQD Sasha Levin
2021-09-09 11:50 ` [PATCH AUTOSEL 5.10 120/176] rpc: fix gss_svc_init cleanup on failure Sasha Levin
2021-09-09 11:50 ` [PATCH AUTOSEL 5.10 121/176] selftests/bpf: Fix flaky send_signal test Sasha Levin
2021-09-09 11:50 ` [PATCH AUTOSEL 5.10 124/176] net: Fix offloading indirect devices dependency on qdisc order creation Sasha Levin
2021-09-09 11:50 ` [PATCH AUTOSEL 5.10 131/176] rtl8xxxu: Fix the handling of TX A-MPDU aggregation Sasha Levin
2021-09-09 11:50 ` [PATCH AUTOSEL 5.10 132/176] rtw88: use read_poll_timeout instead of fixed sleep Sasha Levin
2021-09-09 11:50 ` [PATCH AUTOSEL 5.10 133/176] rtw88: wow: build wow function only if CONFIG_PM is on Sasha Levin
2021-09-09 11:50 ` [PATCH AUTOSEL 5.10 134/176] rtw88: wow: fix size access error of probe request Sasha Levin
2021-09-09 11:50 ` [PATCH AUTOSEL 5.10 135/176] octeontx2-pf: Fix NIX1_RX interface backpressure Sasha Levin
2021-09-09 11:50 ` [PATCH AUTOSEL 5.10 149/176] selftests/bpf: Enlarge select() timeout for test_maps Sasha Levin
2021-09-09 11:51 ` [PATCH AUTOSEL 5.10 160/176] iwlwifi: pcie: free RBs during configure Sasha Levin
2021-09-09 11:51 ` [PATCH AUTOSEL 5.10 161/176] iwlwifi: mvm: fix a memory leak in iwl_mvm_mac_ctxt_beacon_changed Sasha Levin
2021-09-09 11:51 ` [PATCH AUTOSEL 5.10 162/176] iwlwifi: mvm: avoid static queue number aliasing Sasha Levin
2021-09-09 11:51 ` [PATCH AUTOSEL 5.10 163/176] iwlwifi: mvm: fix access to BSS elements Sasha Levin
2021-09-09 11:51 ` [PATCH AUTOSEL 5.10 164/176] iwlwifi: fw: correctly limit to monitor dump Sasha Levin
2021-09-09 11:51 ` [PATCH AUTOSEL 5.10 165/176] iwlwifi: mvm: Fix scan channel flags settings Sasha Levin
2021-09-09 11:51 ` Sasha Levin [this message]
2021-09-09 11:51 ` [PATCH AUTOSEL 5.10 167/176] net/mlx5: DR, Enable QP retransmission Sasha Levin
2021-09-09 11:51 ` [PATCH AUTOSEL 5.10 169/176] selftests/bpf: Fix potential unreleased lock Sasha Levin
2021-09-09 11:51 ` [PATCH AUTOSEL 5.10 170/176] wcn36xx: Fix missing frame timestamp for beacon/probe-resp Sasha Levin
2021-09-09 11:51 ` [PATCH AUTOSEL 5.10 171/176] ath9k: fix OOB read ar9300_eeprom_restore_internal Sasha Levin
2021-09-09 11:51 ` [PATCH AUTOSEL 5.10 172/176] ath9k: fix sleeping in atomic context Sasha Levin
2021-09-09 11:51 ` [PATCH AUTOSEL 5.10 173/176] net: fix NULL pointer reference in cipso_v4_doi_free Sasha Levin
2021-09-09 11:51 ` [PATCH AUTOSEL 5.10 174/176] fix array-index-out-of-bounds in taprio_change Sasha Levin
2021-09-09 11:51 ` [PATCH AUTOSEL 5.10 175/176] net: w5100: check return value after calling platform_get_resource() Sasha Levin
2021-09-09 11:51 ` [PATCH AUTOSEL 5.10 176/176] net: hns3: clean up a type mismatch warning Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210909115118.146181-166-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=Wentao_Liang_g@163.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-rdma@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=saeedm@nvidia.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).