qed: Use after free in qed_rdma_free()

Dan Carpenter · davem330 · commit f89782c2d131 · 2018-03-13T10:54:17.000-04:00
We're dereferencing "p_hwfn->p_rdma_info" but that is freed on the line before in qed_rdma_resc_free(p_hwfn). Fixes: 9de506a ("qed: Free RoCE ILT Memory on rmmod qedr") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Acked-by: Michal Kalderon <Michal.Kalderon@cavium.com> Signed-off-by: David S. Miller <davem@davemloft.net>
diff --git a/drivers/net/ethernet/qlogic/qed/qed_rdma.c b/drivers/net/ethernet/qlogic/qed/qed_rdma.c
@@ -379,8 +379,8 @@ static void qed_rdma_free(struct qed_hwfn *p_hwfn)
 	DP_VERBOSE(p_hwfn, QED_MSG_RDMA, "Freeing RDMA\n");
 
 	qed_rdma_free_reserved_lkey(p_hwfn);
-	qed_rdma_resc_free(p_hwfn);
 	qed_cxt_free_proto_ilt(p_hwfn, p_hwfn->p_rdma_info->proto);
+	qed_rdma_resc_free(p_hwfn);
 }
 
 static void qed_rdma_get_guid(struct qed_hwfn *p_hwfn, u8 *guid)

Original file line number	Diff line number	Diff line change
`@@ -379,8 +379,8 @@ static void qed_rdma_free(struct qed_hwfn *p_hwfn)`
`379`	`379`	`DP_VERBOSE(p_hwfn, QED_MSG_RDMA, "Freeing RDMA\n");`
`380`	`380`
`381`	`381`	`qed_rdma_free_reserved_lkey(p_hwfn);`
`382`		`- qed_rdma_resc_free(p_hwfn);`
`383`	`382`	`qed_cxt_free_proto_ilt(p_hwfn, p_hwfn->p_rdma_info->proto);`
	`383`	`+ qed_rdma_resc_free(p_hwfn);`
`384`	`384`	`}`
`385`	`385`
`386`	`386`	`static void qed_rdma_get_guid(struct qed_hwfn p_hwfn, u8 guid)`