Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 70eeff66 authored by Roland Dreier's avatar Roland Dreier Committed by David S. Miller
Browse files

qed: Fix potential use-after-free in qed_spq_post() 



We need to check if p_ent->comp_mode is QED_SPQ_MODE_EBLOCK before
calling qed_spq_add_entry().  The test is fine is the mode is EBLOCK,
but if it isn't then qed_spq_add_entry() might kfree(p_ent).

Signed-off-by: default avatarRoland Dreier <roland@purestorage.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 0d9c9f0f

drivers/net/ethernet/qlogic/qed/qed_spq.c

+7 −1
Original line number Diff line number Diff line
@@ -776,6 +776,7 @@ int qed_spq_post(struct qed_hwfn *p_hwfn, 
	int rc = 0;

	struct qed_spq *p_spq = p_hwfn ? p_hwfn->p_spq : NULL;

	bool b_ret_ent = true;

	bool eblock;



	if (!p_hwfn)

		return -EINVAL;
@@ -794,6 +795,11 @@ int qed_spq_post(struct qed_hwfn *p_hwfn, 
	if (rc)

		goto spq_post_fail;



	/* Check if entry is in block mode before qed_spq_add_entry,

	 * which might kfree p_ent.

	 */

	eblock = (p_ent->comp_mode == QED_SPQ_MODE_EBLOCK);



	/* Add the request to the pending queue */

	rc = qed_spq_add_entry(p_hwfn, p_ent, p_ent->priority);

	if (rc)
@@ -811,7 +817,7 @@ int qed_spq_post(struct qed_hwfn *p_hwfn, 


	spin_unlock_bh(&p_spq->lock);



	if (p_ent->comp_mode == QED_SPQ_MODE_EBLOCK) {

	if (eblock) {

		/* For entries in QED BLOCK mode, the completion code cannot

		 * perform the necessary cleanup - if it did, we couldn't

		 * access p_ent here to see whether it's successful or not.