| Message ID | YuvbCRstoxopHi4n@kili (mailing list archive) |
|---|---|
| State | Not Applicable |
| Headers | show |
| Series | [net] net/mlx5e: Fix use after free in mlx5e_fs_init() | expand |
On 8/4/2022 5:43 PM, Dan Carpenter wrote: > Call mlx5e_fs_vlan_free(fs) before kvfree(fs). > > Fixes: af8bbf730068 ("net/mlx5e: Convert mlx5e_flow_steering member of mlx5e_priv to pointer") > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> > --- > This applies to net but I never really understand how mellanox patches > work... > Hi Dan, This patch belongs to next kernel (6.0). It seems that net-next (or parts of it) is already merged into net as we're in the merge window. > drivers/net/ethernet/mellanox/mlx5/core/en_fs.c | 5 +++-- > 1 file changed, 3 insertions(+), 2 deletions(-) > > diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c > index e2a9b9be5c1f..e0ce5a233d0b 100644 > --- a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c > +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c > @@ -1395,10 +1395,11 @@ struct mlx5e_flow_steering *mlx5e_fs_init(const struct mlx5e_profile *profile, > } > > return fs; > -err_free_fs: > - kvfree(fs); > + > err_free_vlan: > mlx5e_fs_vlan_free(fs); > +err_free_fs: > + kvfree(fs); > err: > return NULL; > } Reviewed-by: Tariq Toukan <tariqt@nvidia.com> Thanks for your patch!
On Thu, Aug 04, 2022 at 06:04:52PM +0300, Tariq Toukan wrote: > > > On 8/4/2022 5:43 PM, Dan Carpenter wrote: > > Call mlx5e_fs_vlan_free(fs) before kvfree(fs). > > > > Fixes: af8bbf730068 ("net/mlx5e: Convert mlx5e_flow_steering member of mlx5e_priv to pointer") > > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> > > --- > > This applies to net but I never really understand how mellanox patches > > work... > > > > Hi Dan, > This patch belongs to next kernel (6.0). > It seems that net-next (or parts of it) is already merged into net as we're > in the merge window. Right. But commit af8bbf730068 was merged by Saeed. I think that went through his tree and then pulled into one of the networking trees. But sometimes these patches are pulled directly into a networking tree. I can't remember how it works, but it's somehow my job to remember this stuff for 200+ *hundred* different friggin git trees and put the tree name in the subject. :P (small rant). > > Reviewed-by: Tariq Toukan <tariqt@nvidia.com> Thanks! regards, dan carpenter
On Fri, Aug 05, 2022 at 09:21:41AM +0300, Dan Carpenter wrote: > I can't remember how it works, but it's somehow my job to remember this > stuff for 200+ *hundred* different friggin git trees and put the tree > name in the subject. :P (small rant). > Huh. It's actuall 360 trees now. Wow. Anyway, it needs to go into net and not net-next. I've told everyone else besides networking who asks for something like that in the subject that they can pound dirt. regards, dan carpenter
On Fri, 5 Aug 2022 09:26:06 +0300 Dan Carpenter wrote: > Anyway, it needs to go into net and not net-next. I've told everyone > else besides networking who asks for something like that in the subject > that they can pound dirt. We appreciate the special treatment! :]
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c index e2a9b9be5c1f..e0ce5a233d0b 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c @@ -1395,10 +1395,11 @@ struct mlx5e_flow_steering *mlx5e_fs_init(const struct mlx5e_profile *profile, } return fs; -err_free_fs: - kvfree(fs); + err_free_vlan: mlx5e_fs_vlan_free(fs); +err_free_fs: + kvfree(fs); err: return NULL; }
Call mlx5e_fs_vlan_free(fs) before kvfree(fs). Fixes: af8bbf730068 ("net/mlx5e: Convert mlx5e_flow_steering member of mlx5e_priv to pointer") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> --- This applies to net but I never really understand how mellanox patches work... drivers/net/ethernet/mellanox/mlx5/core/en_fs.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)