Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7cfddb81 authored by Saeed Mahameed's avatar Saeed Mahameed Committed by Greg Kroah-Hartman
Browse files

net/mlx5: FPGA, tls, hold rcu read lock a bit longer 



[ Upstream commit 31634bf5dcc418b5b2cacd954394c0c4620db6a2 ]

To avoid use-after-free, hold the rcu read lock until we are done copying
flow data into the command buffer.

Fixes: ab412e1d ("net/mlx5: Accel, add TLS rx offload routines")
Reported-by: default avatarEric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: default avatarSaeed Mahameed <saeedm@mellanox.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent d1785bea

drivers/net/ethernet/mellanox/mlx5/core/fpga/tls.c

+9 −9
Original line number Diff line number Diff line
@@ -217,22 +217,22 @@ int mlx5_fpga_tls_resync_rx(struct mlx5_core_dev *mdev, u32 handle, u32 seq, 
	void *cmd;

	int ret;



	rcu_read_lock();

	flow = idr_find(&mdev->fpga->tls->rx_idr, ntohl(handle));

	rcu_read_unlock();



	if (!flow) {

		WARN_ONCE(1, "Received NULL pointer for handle\n");

		return -EINVAL;

	}



	buf = kzalloc(size, GFP_ATOMIC);

	if (!buf)

		return -ENOMEM;



	cmd = (buf + 1);



	rcu_read_lock();

	flow = idr_find(&mdev->fpga->tls->rx_idr, ntohl(handle));

	if (unlikely(!flow)) {

		rcu_read_unlock();

		WARN_ONCE(1, "Received NULL pointer for handle\n");

		kfree(buf);

		return -EINVAL;

	}

	mlx5_fpga_tls_flow_to_cmd(flow, cmd);

	rcu_read_unlock();



	MLX5_SET(tls_cmd, cmd, swid, ntohl(handle));

	MLX5_SET64(tls_cmd, cmd, tls_rcd_sn, be64_to_cpu(rcd_sn));