linux-stable/include/linux/qed
Yuval Basson 8063f761cd qed: Fix use after free in qed_chain_free
The qed_chain data structure was modified in
commit 1a4a69751f ("qed: Chain support for external PBL") to support
receiving an external pbl (due to iWARP FW requirements).
The pages pointed to by the pbl are allocated in qed_chain_alloc
and their virtual address are stored in an virtual addresses array to
enable accessing and freeing the data. The physical addresses however
weren't stored and were accessed directly from the external-pbl
during free.

Destroy-qp flow, leads to freeing the external pbl before the chain is
freed, when the chain is freed it tries accessing the already freed
external pbl, leading to a use-after-free. Therefore we need to store
the physical addresses in additional to the virtual addresses in a
new data structure.

Fixes: 1a4a69751f ("qed: Chain support for external PBL")
Signed-off-by: Michal Kalderon <mkalderon@marvell.com>
Signed-off-by: Yuval Bason <ybason@marvell.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-03-30 11:45:18 -07:00
..
common_hsi.h qed: FW 8.42.2.0 HSI changes 2020-01-27 14:35:32 +01:00
eth_common.h qed: FW 8.42.2.0 HSI changes 2020-01-27 14:35:32 +01:00
fcoe_common.h
iscsi_common.h qed: FW 8.42.2.0 iscsi/fcoe changes 2020-01-27 14:35:32 +01:00
iwarp_common.h
qed_chain.h qed: Fix use after free in qed_chain_free 2020-03-30 11:45:18 -07:00
qed_eth_if.h
qed_fcoe_if.h
qed_if.h qed: FW 8.42.2.0 debug features 2020-01-27 14:35:32 +01:00
qed_iov_if.h
qed_iscsi_if.h
qed_ll2_if.h qed: FW 8.42.2.0 Additional ll2 type 2020-01-27 14:35:32 +01:00
qed_rdma_if.h qed*: Change dpi_addr to be denoted with __iomem 2019-07-25 15:03:26 -03:00
qede_rdma.h
rdma_common.h
roce_common.h
storage_common.h qed: FW 8.42.2.0 iscsi/fcoe changes 2020-01-27 14:35:32 +01:00
tcp_common.h