Skip to contentSkip to conversation

qed: Use after free in qed_rdma_free()

PATCH Applied Dan Carpenter 3 participants 3 messages Mar 13, 2018

Subsystems (4)
Networking Network drivers Kernel janitors QLogic QL4xxx Ethernet driver
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 qed: Use after free in qed_rdma_free()

We're dereferencing "p_hwfn->p_rdma_info" but that is freed on the line before in qed_rdma_resc_free(p_hwfn).

Fixes 9de506a547c0 ("qed: Free RoCE ILT Memory on rmmod qedr")
Signed-off-by Dan Carpenter <[email protected]>
drivers/net/ethernet/qlogic/qed/qed_rdma.c +1 -1
index f3ee6538b553..a411f9c702a1 100644
@@ -379,8 +379,8 @@ static void qed_rdma_free(struct qed_hwfn *p_hwfn)
 	DP_VERBOSE(p_hwfn, QED_MSG_RDMA, "Freeing RDMA\n");
 
 	qed_rdma_free_reserved_lkey(p_hwfn);
-	qed_rdma_resc_free(p_hwfn);
 	qed_cxt_free_proto_ilt(p_hwfn, p_hwfn->p_rdma_info->proto);
+	qed_rdma_resc_free(p_hwfn);
 }
 
 static void qed_rdma_get_guid(struct qed_hwfn *p_hwfn, u8 *guid)
Acked-by on v1 1/1
#1 lore raw
Quoted 29 lines

From: Dan Carpenter [mailto:[email protected]]
Sent: Tuesday, March 13, 2018 11:10 AM
To: Elior, Ariel <[email protected]>; Kalderon, Michal <[email protected]>
Cc: Dept-Eng Everest Linux L2 <[email protected]>; [email protected]; [email protected]
Subject: [PATCH net] qed: Use after free in qed_rdma_free()

We're dereferencing "p_hwfn->p_rdma_info" but that is freed on the line before in qed_rdma_resc_free(p_hwfn).

Fixes 9de506a547c0 ("qed: Free RoCE ILT Memory on rmmod qedr")
Signed-off-by Dan Carpenter <[email protected]>
drivers/net/ethernet/qlogic/qed/qed_rdma.c +1 -1
index f3ee6538b553..a411f9c702a1 100644
@@ -379,8 +379,8 @@ static void qed_rdma_free(struct qed_hwfn
 *p_hwfn)
 	DP_VERBOSE(p_hwfn, QED_MSG_RDMA, "Freeing RDMA\n");
 
 	qed_rdma_free_reserved_lkey(p_hwfn);
-	qed_rdma_resc_free(p_hwfn);
 	qed_cxt_free_proto_ilt(p_hwfn, p_hwfn->p_rdma_info->proto);
+	qed_rdma_resc_free(p_hwfn);
 }
Quoted 1 line

static void qed_rdma_get_guid(struct qed_hwfn *p_hwfn, u8 *guid)

Thanks,

Acked-by Michal Kalderon <[email protected]>