Skip to contentSkip to conversation

net/mlx5: Fix use-after-free

PATCH Applied Gustavo A. R. Silva 3 participants 3 messages Mar 22, 2018 – Mar 23, 2018

Subsystems (5)
Networking Network drivers InfiniBand Mellanox mlx5 core +1 more subsystems
lore
Share & tools
lore

Gustavo A. R. Silva

author
#0 lore raw

PATCH v2 1/1 net/mlx5: Fix use-after-free

_rule_ is being freed and then dereferenced by accessing rule->ctx

Fix this by copying the value returned by PTR_ERR(rule->ctx) into a local variable for its safe use after freeing _rule_

Addresses-Coverity-ID: 1466041 ("Read from pointer after free")

Fixes 05564d0ae075 ("net/mlx5: Add flow-steering commands for FPGA IPSec implementation")
Reviewed-by Yuval Shaia <[email protected]>
Signed-off-by Gustavo A. R. Silva <[email protected]>

---
Changes in v2:
- Use a short subject prefix as suggested by Yuval Shaia.
- Add Yuval's Reviewed-by.

 drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c +2 -1
index 4f15685..0f5da49 100644
@@ -1061,8 +1061,9 @@ static int fpga_ipsec_fs_create_fte(struct mlx5_core_dev *dev,
 
 	rule->ctx = mlx5_fpga_ipsec_fs_create_sa_ctx(dev, fte, is_egress);
 	if (IS_ERR(rule->ctx)) {
+		int err = PTR_ERR(rule->ctx);
 		kfree(rule);
-		return PTR_ERR(rule->ctx);
+		return err;
 	}
 
 	rule->fte = fte;
Signature · 1 line
2.7.4
Acked-by on v2 1/1
#1 lore raw
Quoted 11 lines · Gustavo A. R. Silva

_rule_ is being freed and then dereferenced by accessing rule->ctx

Fix this by copying the value returned by PTR_ERR(rule->ctx) into a local
variable for its safe use after freeing _rule_

Addresses-Coverity-ID: 1466041 ("Read from pointer after free")

Fixes 05564d0ae075 ("net/mlx5: Add flow-steering commands for FPGA

IPSec implementation")

Reviewed-by Yuval Shaia <[email protected]>
Signed-off-by Gustavo A. R. Silva <[email protected]>
Acked-by Saeed Mahameed <[email protected]>
Quoted 26 lines

---
Changes in v2:
- Use a short subject prefix as suggested by Yuval Shaia.
- Add Yuval's Reviewed-by.

 drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/fpga/ipsec.c +2 -1
index 4f15685..0f5da49 100644
@@ -1061,8 +1061,9 @@ static int fpga_ipsec_fs_create_fte(struct
 mlx5_core_dev *dev,
 
 	rule->ctx = mlx5_fpga_ipsec_fs_create_sa_ctx(dev, fte,
 is_egress);
 	if (IS_ERR(rule->ctx)) {
+		int err = PTR_ERR(rule->ctx);
 		kfree(rule);
-		return PTR_ERR(rule->ctx);
+		return err;
 	}

rule->fte = fte;

maintainer Applied
#2 lore raw
In reply to Gustavo A. R. Silva

From: "Gustavo A. R. Silva" <[email protected]>
Date: Thu, 22 Mar 2018 13:44:56 -0500

Quoted 5 lines

_rule_ is being freed and then dereferenced by accessing rule->ctx

Fix this by copying the value returned by PTR_ERR(rule->ctx) into a local variable for its safe use after freeing _rule_

Quoted 8 lines

Addresses-Coverity-ID: 1466041 ("Read from pointer after free")

Fixes 05564d0ae075 ("net/mlx5: Add flow-steering commands for FPGA IPSec implementation")
Reviewed-by Yuval Shaia <[email protected]>
Signed-off-by Gustavo A. R. Silva <[email protected]>

---
Changes in v2:
- Use a short subject prefix as suggested by Yuval Shaia.
- Add Yuval's Reviewed-by.

Applied to net-next.

Thank you.