Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1462127 > unrolled thread
| Started by | Vincent Stehlé <vincent.stehle@laposte.net> |
|---|---|
| First post | 2016-08-14 15:50 +0200 |
| Last post | 2016-08-15 06:40 +0200 |
| Articles | 3 — 3 participants |
Back to article view | Back to linux.kernel
[PATCH] mlxsw: spectrum_router: Fix use after free Vincent Stehlé <vincent.stehle@laposte.net> - 2016-08-14 15:50 +0200
Re: [PATCH] mlxsw: spectrum_router: Fix use after free Ido Schimmel <idosch@idosch.org> - 2016-08-14 18:00 +0200
Re: [PATCH] mlxsw: spectrum_router: Fix use after free David Miller <davem@davemloft.net> - 2016-08-15 06:40 +0200
| From | Vincent Stehlé <vincent.stehle@laposte.net> |
|---|---|
| Date | 2016-08-14 15:50 +0200 |
| Subject | [PATCH] mlxsw: spectrum_router: Fix use after free |
| Message-ID | <s63XA-jN-7@gated-at.bofh.it> |
In mlxsw_sp_router_fib4_add_info_destroy(), the fib_entry pointer is used
after it has been freed by mlxsw_sp_fib_entry_destroy(). Use a temporary
variable to fix this.
Fixes: 61c503f976b5449e ("mlxsw: spectrum_router: Implement fib4 add/del switchdev obj ops")
Signed-off-by: Vincent Stehlé <vincent.stehle@laposte.net>
Cc: Jiri Pirko <jiri@mellanox.com>
---
drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
index 81418d6..90bb93b 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
@@ -1651,9 +1651,10 @@ static void mlxsw_sp_router_fib4_add_info_destroy(void const *data)
const struct mlxsw_sp_router_fib4_add_info *info = data;
struct mlxsw_sp_fib_entry *fib_entry = info->fib_entry;
struct mlxsw_sp *mlxsw_sp = info->mlxsw_sp;
+ struct mlxsw_sp_vr *vr = fib_entry->vr;
mlxsw_sp_fib_entry_destroy(fib_entry);
- mlxsw_sp_vr_put(mlxsw_sp, fib_entry->vr);
+ mlxsw_sp_vr_put(mlxsw_sp, vr);
kfree(info);
}
--
2.8.1
[toc] | [next] | [standalone]
| From | Ido Schimmel <idosch@idosch.org> |
|---|---|
| Date | 2016-08-14 18:00 +0200 |
| Message-ID | <s65Zn-1vU-7@gated-at.bofh.it> |
| In reply to | #1462127 |
On Sun, Aug 14, 2016 at 03:38:29PM +0200, Vincent Stehlé wrote:
> In mlxsw_sp_router_fib4_add_info_destroy(), the fib_entry pointer is used
> after it has been freed by mlxsw_sp_fib_entry_destroy(). Use a temporary
> variable to fix this.
>
> Fixes: 61c503f976b5449e ("mlxsw: spectrum_router: Implement fib4 add/del switchdev obj ops")
> Signed-off-by: Vincent Stehlé <vincent.stehle@laposte.net>
> Cc: Jiri Pirko <jiri@mellanox.com>
Acked-by: Ido Schimmel <idosch@mellanox.com>
Thank you.
[toc] | [prev] | [next] | [standalone]
| From | David Miller <davem@davemloft.net> |
|---|---|
| Date | 2016-08-15 06:40 +0200 |
| Message-ID | <s6hQS-OZ-13@gated-at.bofh.it> |
| In reply to | #1462127 |
From: Vincent Stehlé <vincent.stehle@laposte.net>
Date: Sun, 14 Aug 2016 15:38:29 +0200
> In mlxsw_sp_router_fib4_add_info_destroy(), the fib_entry pointer is used
> after it has been freed by mlxsw_sp_fib_entry_destroy(). Use a temporary
> variable to fix this.
>
> Fixes: 61c503f976b5449e ("mlxsw: spectrum_router: Implement fib4 add/del switchdev obj ops")
> Signed-off-by: Vincent Stehlé <vincent.stehle@laposte.net>
> Cc: Jiri Pirko <jiri@mellanox.com>
Applied.
[toc] | [prev] | [standalone]
Back to top | Article view | linux.kernel
csiph-web