Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit eb8fc323 authored by Vincent's avatar Vincent Committed by David S. Miller
Browse files

mlxsw: spectrum_router: Fix use after free 



In mlxsw_sp_router_fib4_add_info_destroy(), the fib_entry pointer is used
after it has been freed by mlxsw_sp_fib_entry_destroy(). Use a temporary
variable to fix this.

Fixes: 61c503f9 ("mlxsw: spectrum_router: Implement fib4 add/del switchdev obj ops")
Signed-off-by: default avatarVincent Stehlé <vincent.stehle@laposte.net>
Cc: Jiri Pirko <jiri@mellanox.com>
Acked-by: default avatarIdo Schimmel <idosch@mellanox.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 4cf0b354

drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c

+2 −1
Original line number Original line Diff line number Diff line
@@ -1651,9 +1651,10 @@ static void mlxsw_sp_router_fib4_add_info_destroy(void const *data) 
	const struct mlxsw_sp_router_fib4_add_info *info = data;

	const struct mlxsw_sp_router_fib4_add_info *info = data;

	struct mlxsw_sp_fib_entry *fib_entry = info->fib_entry;

	struct mlxsw_sp_fib_entry *fib_entry = info->fib_entry;

	struct mlxsw_sp *mlxsw_sp = info->mlxsw_sp;

	struct mlxsw_sp *mlxsw_sp = info->mlxsw_sp;

	struct mlxsw_sp_vr *vr = fib_entry->vr;





	mlxsw_sp_fib_entry_destroy(fib_entry);

	mlxsw_sp_fib_entry_destroy(fib_entry);

	mlxsw_sp_vr_put(mlxsw_sp, fib_entry->vr);

	mlxsw_sp_vr_put(mlxsw_sp, vr);

	kfree(info);

	kfree(info);

}

}