Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 433c5813 authored by Mustafa Ismail's avatar Mustafa Ismail Committed by Doug Ledford
Browse files

i40iw: Avoid writing to freed memory 



iwpbl->iwmr points to the structure that contains iwpbl,
which is iwmr. Setting this to NULL would result in
writing to freed memory. So just free iwmr, and return.

Fixes: d3749841 ("i40iw: add files for iwarp interface")

Reported-by: default avatarStefan Assmann <sassmann@redhat.com>
Signed-off-by: default avatarMustafa Ismail <mustafa.ismail@intel.com>
Signed-off-by: default avatarShiraz Saleem <shiraz.saleem@intel.com>
Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
parent d41d0910

drivers/infiniband/hw/i40iw/i40iw_verbs.c

+1 −2
Original line number Diff line number Diff line
@@ -1925,8 +1925,7 @@ static int i40iw_dereg_mr(struct ib_mr *ib_mr) 
		}

		if (iwpbl->pbl_allocated)

			i40iw_free_pble(iwdev->pble_rsrc, palloc);

		kfree(iwpbl->iwmr);

		iwpbl->iwmr = NULL;

		kfree(iwmr);

		return 0;

	}