]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
mlxsw: spectrum: Fix use-after-free of split/unsplit/type_set in case reload fails
authorJiri Pirko <jiri@mellanox.com>
Thu, 21 May 2020 12:11:44 +0000 (15:11 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 3 Jun 2020 06:22:57 +0000 (08:22 +0200)
commitac1902c251dbb92fe65c70226276680f64b9bd6b
treee1e15bc9d42aa4d3f0e382079f6a7b3ec265ac49
parent7091e72cf0cf7478bf02c63ea0e8679014ef1f43
mlxsw: spectrum: Fix use-after-free of split/unsplit/type_set in case reload fails

commit 4340f42f207eacb81e7a6b6bb1e3b6afad9a2e26 upstream.

In case of reload fail, the mlxsw_sp->ports contains a pointer to a
freed memory (either by reload_down() or reload_up() error path).
Fix this by initializing the pointer to NULL and checking it before
dereferencing in split/unsplit/type_set callpaths.

Fixes: 24cc68ad6c46 ("mlxsw: core: Add support for reload")
Reported-by: Danielle Ratson <danieller@mellanox.com>
Signed-off-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: Ido Schimmel <idosch@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/net/ethernet/mellanox/mlxsw/spectrum.c
drivers/net/ethernet/mellanox/mlxsw/switchx2.c