[patch] net/mlx4_en: dereferencing freed memory

Subsystems: mellanox ethernet driver (mlx4_en), mellanox mlx4 core vpi driver, networking drivers, the rest

STALE5144d

2 messages, 2 authors, 2012-07-17 · open the first message on its own page

[patch] net/mlx4_en: dereferencing freed memory

From: Dan Carpenter <hidden>
Date: 2012-07-11 06:34:27 

We dereferenced "mclist" after the kfree().

Signed-off-by: Dan Carpenter <redacted>

diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index 94375a8..4ce5ca8 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -503,9 +503,7 @@ static void mlx4_en_do_set_multicast(struct work_struct *work)
 				/* remove from list */
 				list_del(&mclist->list);
 				kfree(mclist);
-			}
-
-			if (mclist->action == MCLIST_ADD) {
+			} else if (mclist->action == MCLIST_ADD) {
 				/* attach the address */
 				memcpy(&mc_list[10], mclist->addr, ETH_ALEN);
 				/* needed for B0 steering support */

Re: [patch] net/mlx4_en: dereferencing freed memory

From: David Miller <davem@davemloft.net>
Date: 2012-07-17 05:58:54 

From: Dan Carpenter <redacted>
Date: Wed, 11 Jul 2012 09:34:07 +0300

We dereferenced "mclist" after the kfree().

Signed-off-by: Dan Carpenter <redacted>
Applied.
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help