Kernel/linux-next
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git synced 2025-01-11 08:18:47 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

mlx5_core: Fix use after free in mlx5_cmd_comp_handler()

Browse Source 
We can't dereference "ent" after passing it to free_cmd().

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Eli Cohen <eli@mellanox.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
This commit is contained in:
Dan Carpenter 2013-07-22 11:02:01 +03:00 committed by Roland Dreier
parent 92b0ca7cb1
commit 11940c8728
1 changed files with 7 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
drivers/net/ethernet/mellanox/mlx5/core/cmd.c
View File

@ -1113,7 +1113,13 @@ void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, unsigned long vector)
for (i = 0; i < (1 << cmd->log_sz); i++) { for (i = 0; i < (1 << cmd->log_sz); i++) {
if (test_bit(i, &vector)) { if (test_bit(i, &vector)) {
struct semaphore *sem;
ent = cmd->ent_arr[i]; ent = cmd->ent_arr[i];
if (ent->page_queue)
sem = &cmd->pages_sem;
else
sem = &cmd->sem;
ktime_get_ts(&ent->ts2); ktime_get_ts(&ent->ts2);
memcpy(ent->out->first.data, ent->lay->out, sizeof(ent->lay->out)); memcpy(ent->out->first.data, ent->lay->out, sizeof(ent->lay->out));
dump_command(dev, ent, 0); dump_command(dev, ent, 0);
@ -1136,10 +1142,7 @@ void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, unsigned long vector)
} else { } else {
complete(&ent->done); complete(&ent->done);
} }
if (ent->page_queue) up(sem);
up(&cmd->pages_sem);
else
up(&cmd->sem);
} }
} }
} }