Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f4cee3af authored by Jiri Pirko's avatar Jiri Pirko Committed by David S. Miller
Browse files

mlxsw: core: Use devm_kzalloc to allocate mlxsw_hwmon structure 



KASan reported use-after-free for the hwmon structure. So fix this by
using devm_kzalloc and let the core take care about freeing the memory
during device dettach.

Reported-by: default avatarIdo Schimmel <idosch@mellanox.com>
Fixes: 89309da3 ("mlxsw: core: Implement temperature hwmon interface")
Signed-off-by: default avatarJiri Pirko <jiri@mellanox.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 2010b93e

drivers/net/ethernet/mellanox/mlxsw/core.c

+0 −2
Original line number Diff line number Diff line
@@ -855,7 +855,6 @@ int mlxsw_core_bus_device_register(const struct mlxsw_bus_info *mlxsw_bus_info, 
err_debugfs_init:

	mlxsw_core->driver->fini(mlxsw_core->driver_priv);

err_driver_init:

	mlxsw_hwmon_fini(mlxsw_core->hwmon);

err_hwmon_init:

	mlxsw_emad_fini(mlxsw_core);

err_emad_init:
@@ -878,7 +877,6 @@ void mlxsw_core_bus_device_unregister(struct mlxsw_core *mlxsw_core) 


	mlxsw_core_debugfs_fini(mlxsw_core);

	mlxsw_core->driver->fini(mlxsw_core->driver_priv);

	mlxsw_hwmon_fini(mlxsw_core->hwmon);

	mlxsw_emad_fini(mlxsw_core);

	mlxsw_core->bus->fini(mlxsw_core->bus_priv);

	kfree(mlxsw_core->lag.mapping);

drivers/net/ethernet/mellanox/mlxsw/core.h

+0 −4
Original line number Diff line number Diff line
@@ -239,10 +239,6 @@ static inline int mlxsw_hwmon_init(struct mlxsw_core *mlxsw_core, 
	return 0;

}



static inline void mlxsw_hwmon_fini(struct mlxsw_hwmon *mlxsw_hwmon)

{

}



#endif



#endif

drivers/net/ethernet/mellanox/mlxsw/core_hwmon.c

+2 −7
Original line number Diff line number Diff line
@@ -334,7 +334,8 @@ int mlxsw_hwmon_init(struct mlxsw_core *mlxsw_core, 
	struct device *hwmon_dev;

	int err;



	mlxsw_hwmon = kzalloc(sizeof(*mlxsw_hwmon), GFP_KERNEL);

	mlxsw_hwmon = devm_kzalloc(mlxsw_bus_info->dev, sizeof(*mlxsw_hwmon),

				   GFP_KERNEL);

	if (!mlxsw_hwmon)

		return -ENOMEM;

	mlxsw_hwmon->core = mlxsw_core;
@@ -367,11 +368,5 @@ int mlxsw_hwmon_init(struct mlxsw_core *mlxsw_core, 
err_hwmon_register:

err_fans_init:

err_temp_init:

	kfree(mlxsw_hwmon);

	return err;

}
 


void mlxsw_hwmon_fini(struct mlxsw_hwmon *mlxsw_hwmon)

{

	kfree(mlxsw_hwmon);

}