[PATCH net] qed: Use after free in qed_rdma_free()

Subsystems: networking drivers, qlogic ql4xxx ethernet driver, the rest

STALE3140d

3 messages, 3 authors, 2018-03-13 · open the first message on its own page

[PATCH net] qed: Use after free in qed_rdma_free()

From: Dan Carpenter <hidden>
Date: 2018-03-13 09:09:49 

We're dereferencing "p_hwfn->p_rdma_info" but that is freed on the line
before in qed_rdma_resc_free(p_hwfn).

Fixes: 9de506a547c0 ("qed: Free RoCE ILT Memory on rmmod qedr")
Signed-off-by: Dan Carpenter <redacted>

diff --git a/drivers/net/ethernet/qlogic/qed/qed_rdma.c b/drivers/net/ethernet/qlogic/qed/qed_rdma.c
index f3ee6538b553..a411f9c702a1 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_rdma.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_rdma.c
@@ -379,8 +379,8 @@ static void qed_rdma_free(struct qed_hwfn *p_hwfn)
 	DP_VERBOSE(p_hwfn, QED_MSG_RDMA, "Freeing RDMA\n");
 
 	qed_rdma_free_reserved_lkey(p_hwfn);
-	qed_rdma_resc_free(p_hwfn);
 	qed_cxt_free_proto_ilt(p_hwfn, p_hwfn->p_rdma_info->proto);
+	qed_rdma_resc_free(p_hwfn);
 }
 
 static void qed_rdma_get_guid(struct qed_hwfn *p_hwfn, u8 *guid)

RE: [PATCH net] qed: Use after free in qed_rdma_free()

From: Kalderon, Michal <hidden>
Date: 2018-03-13 09:40:24

quoted hunk
From: Dan Carpenter [mailto:dan.carpenter@oracle.com]
Sent: Tuesday, March 13, 2018 11:10 AM
To: Elior, Ariel <redacted>; Kalderon, Michal
[off-list ref]
Cc: Dept-Eng Everest Linux L2 <redacted>;
netdev@vger.kernel.org; kernel-janitors@vger.kernel.org
Subject: [PATCH net] qed: Use after free in qed_rdma_free()

We're dereferencing "p_hwfn->p_rdma_info" but that is freed on the line
before in qed_rdma_resc_free(p_hwfn).

Fixes: 9de506a547c0 ("qed: Free RoCE ILT Memory on rmmod qedr")
Signed-off-by: Dan Carpenter <redacted>

diff --git a/drivers/net/ethernet/qlogic/qed/qed_rdma.c
b/drivers/net/ethernet/qlogic/qed/qed_rdma.c
index f3ee6538b553..a411f9c702a1 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_rdma.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_rdma.c
@@ -379,8 +379,8 @@ static void qed_rdma_free(struct qed_hwfn
*p_hwfn)
 	DP_VERBOSE(p_hwfn, QED_MSG_RDMA, "Freeing RDMA\n");

 	qed_rdma_free_reserved_lkey(p_hwfn);
-	qed_rdma_resc_free(p_hwfn);
 	qed_cxt_free_proto_ilt(p_hwfn, p_hwfn->p_rdma_info->proto);
+	qed_rdma_resc_free(p_hwfn);
 }

 static void qed_rdma_get_guid(struct qed_hwfn *p_hwfn, u8 *guid)
Thanks,

Acked-by: Michal Kalderon <redacted>

Re: [PATCH net] qed: Use after free in qed_rdma_free()

From: David Miller <davem@davemloft.net>
Date: 2018-03-13 14:55:03 

From: Dan Carpenter <redacted>
Date: Tue, 13 Mar 2018 12:09:38 +0300

We're dereferencing "p_hwfn->p_rdma_info" but that is freed on the line
before in qed_rdma_resc_free(p_hwfn).

Fixes: 9de506a547c0 ("qed: Free RoCE ILT Memory on rmmod qedr")
Signed-off-by: Dan Carpenter <redacted>
Applied, thank you.
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help