From: Wentao_Liang Date: Thu, 19 Aug 2021 14:30:05 +0000 (+0800) Subject: net/mlx5: DR, fix a potential use-after-free bug X-Git-Tag: v5.15-rc1~157^2^2~3^2 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=6cc64770fb386b10a64a1fe09328396de7bb5262;p=thirdparty%2Fkernel%2Flinux.git net/mlx5: DR, fix a potential use-after-free bug In line 849 (#1), "mlx5dr_htbl_put(cur_htbl);" drops the reference to cur_htbl and may cause cur_htbl to be freed. However, cur_htbl is subsequently used in the next line, which may result in an use-after-free bug. Fix this by calling mlx5dr_err() before the cur_htbl is put. Signed-off-by: Wentao_Liang Signed-off-by: Saeed Mahameed --- diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_rule.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_rule.c index 43356fad53deb..ffdfb5a94b14b 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_rule.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_rule.c @@ -846,9 +846,9 @@ again: new_htbl = dr_rule_rehash(rule, nic_rule, cur_htbl, ste_location, send_ste_list); if (!new_htbl) { - mlx5dr_htbl_put(cur_htbl); mlx5dr_err(dmn, "Failed creating rehash table, htbl-log_size: %d\n", cur_htbl->chunk_size); + mlx5dr_htbl_put(cur_htbl); } else { cur_htbl = new_htbl; }