mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-08 09:39:40 +00:00
qed: Fix a potential use-after-free in qed_cxt_tables_alloc
[ Upstream commitb65d52ac9c
] qed_ilt_shadow_alloc() will call qed_ilt_shadow_free() to free p_hwfn->p_cxt_mngr->ilt_shadow on error. However, qed_cxt_tables_alloc() accesses the freed pointer on failure of qed_ilt_shadow_alloc() through calling qed_cxt_mngr_free(), which may lead to use-after-free. Fix this issue by setting p_mngr->ilt_shadow to NULL in qed_ilt_shadow_free(). Fixes:fe56b9e6a8
("qed: Add module with basic common support") Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com> Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn> Link: https://lore.kernel.org/r/20231210045255.21383-1-dinghao.liu@zju.edu.cn Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
54f59a242b
commit
7106a15b96
1 changed files with 1 additions and 0 deletions
|
@ -933,6 +933,7 @@ static void qed_ilt_shadow_free(struct qed_hwfn *p_hwfn)
|
|||
p_dma->virt_addr = NULL;
|
||||
}
|
||||
kfree(p_mngr->ilt_shadow);
|
||||
p_mngr->ilt_shadow = NULL;
|
||||
}
|
||||
|
||||
static int qed_ilt_blk_alloc(struct qed_hwfn *p_hwfn,
|
||||
|
|
Loading…
Reference in a new issue