Commit 3dfc1004 authored May 02, 2023 by Shay Drory Committed by Greg Kroah-Hartman May 30, 2023

net/mlx5: Devcom, fix error flow in mlx5_devcom_register_device



commit af87194352cad882d787d06fb7efa714acd95427 upstream.

In case devcom allocation is failed, mlx5 is always freeing the priv.
However, this priv might have been allocated by a different thread,
and freeing it might lead to use-after-free bugs.
Fix it by freeing the priv only in case it was allocated by the
running thread.

Fixes: fadd59fc ("net/mlx5: Introduce inter-device communication mechanism")
Signed-off-by: Shay Drory <shayd@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent c59106f8

drivers/net/ethernet/mellanox/mlx5/core/lib/devcom.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -110,6 +110,7 @@ struct mlx5_devcom mlx5_devcom_register_device(struct mlx5_core_dev dev)
		priv->devs[idx] = dev;
		devcom = mlx5_devcom_alloc(priv, idx);
		if (!devcom) {
		if (new_priv)
		kfree(priv);
		return ERR_PTR(-ENOMEM);
		}