Commit 065f225e authored Jun 23, 2020 by Alexander Lobakin Committed by Sasha Levin Jun 30, 2020

net: qede: fix use-after-free on recovery and AER handling



[ Upstream commit ec6c80590bde6b5dfa4970fffa3572f1acd313ca ]

Set edev->cdev pointer to NULL after calling remove() callback to avoid
using of already freed object.

Fixes: ccc67ef5 ("qede: Error recovery process")
Signed-off-by: Alexander Lobakin <alobakin@marvell.com>
Signed-off-by: Igor Russkikh <irusskikh@marvell.com>
Signed-off-by: Michal Kalderon <michal.kalderon@marvell.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>

parent f490e70f

drivers/net/ethernet/qlogic/qede/qede_main.c

+1 −0

Original line number	Diff line number	Diff line
		@@ -1247,6 +1247,7 @@ static void __qede_remove(struct pci_dev *pdev, enum qede_remove_mode mode)
		if (system_state == SYSTEM_POWER_OFF)
		return;
		qed_ops->common->remove(cdev);
		edev->cdev = NULL;

		/* Since this can happen out-of-sync with other flows,
		* don't release the netdevice until after slowpath stop