mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-23 01:10:04 +00:00
net/qlcnic: Fix a use after free in qlcnic_83xx_get_minidump_template
In qlcnic_83xx_get_minidump_template, fw_dump->tmpl_hdr was freed by
vfree(). But unfortunately, it is used when extended is true.
Fixes: 7061b2bdd6
("qlogic: Deletion of unnecessary checks before two function calls")
Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
ce6c13e4f5
commit
db74623a38
1 changed files with 3 additions and 0 deletions
|
@ -1425,6 +1425,7 @@ void qlcnic_83xx_get_minidump_template(struct qlcnic_adapter *adapter)
|
|||
|
||||
if (fw_dump->tmpl_hdr == NULL || current_version > prev_version) {
|
||||
vfree(fw_dump->tmpl_hdr);
|
||||
fw_dump->tmpl_hdr = NULL;
|
||||
|
||||
if (qlcnic_83xx_md_check_extended_dump_capability(adapter))
|
||||
extended = !qlcnic_83xx_extend_md_capab(adapter);
|
||||
|
@ -1443,6 +1444,8 @@ void qlcnic_83xx_get_minidump_template(struct qlcnic_adapter *adapter)
|
|||
struct qlcnic_83xx_dump_template_hdr *hdr;
|
||||
|
||||
hdr = fw_dump->tmpl_hdr;
|
||||
if (!hdr)
|
||||
return;
|
||||
hdr->drv_cap_mask = 0x1f;
|
||||
fw_dump->cap_mask = 0x1f;
|
||||
dev_info(&pdev->dev,
|
||||
|
|
Loading…
Reference in a new issue