Skip to content

Commit af87194

Browse files
shayshyiSaeed Mahameed
authored andcommitted
net/mlx5: Devcom, fix error flow in mlx5_devcom_register_device
In case devcom allocation is failed, mlx5 is always freeing the priv. However, this priv might have been allocated by a different thread, and freeing it might lead to use-after-free bugs. Fix it by freeing the priv only in case it was allocated by the running thread. Fixes: fadd59f ("net/mlx5: Introduce inter-device communication mechanism") Signed-off-by: Shay Drory <[email protected]> Signed-off-by: Saeed Mahameed <[email protected]>
1 parent 8c253df commit af87194

File tree

1 file changed

+2
-1
lines changed
  • drivers/net/ethernet/mellanox/mlx5/core/lib

1 file changed

+2
-1
lines changed

drivers/net/ethernet/mellanox/mlx5/core/lib/devcom.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -112,7 +112,8 @@ struct mlx5_devcom *mlx5_devcom_register_device(struct mlx5_core_dev *dev)
112112
priv->devs[idx] = dev;
113113
devcom = mlx5_devcom_alloc(priv, idx);
114114
if (!devcom) {
115-
kfree(priv);
115+
if (new_priv)
116+
kfree(priv);
116117
return ERR_PTR(-ENOMEM);
117118
}
118119

0 commit comments

Comments
 (0)