From patchwork Sun Aug 14 13:38:29 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Vincent_Stehl=C3=A9?= X-Patchwork-Id: 659032 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3sC0Hk5p8jz9syB for ; Sun, 14 Aug 2016 23:45:22 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752807AbcHNNpC (ORCPT ); Sun, 14 Aug 2016 09:45:02 -0400 Received: from smtpfb1-g21.free.fr ([212.27.42.9]:33663 "EHLO smtpfb1-g21.free.fr" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752104AbcHNNpC (ORCPT ); Sun, 14 Aug 2016 09:45:02 -0400 X-Greylist: delayed 375 seconds by postgrey-1.27 at vger.kernel.org; Sun, 14 Aug 2016 09:45:00 EDT Received: from smtp3-g21.free.fr (smtp3-g21.free.fr [212.27.42.3]) by smtpfb1-g21.free.fr (Postfix) with ESMTP id 519BD77FBDA; Sun, 14 Aug 2016 15:38:46 +0200 (CEST) Received: from romuald.bergerie (unknown [88.178.86.202]) by smtp3-g21.free.fr (Postfix) with ESMTPS id 28FBA13F741; Sun, 14 Aug 2016 13:44:59 +0200 (CEST) Received: from radicelle.bergerie (radicelle.bergerie [192.168.124.12]) by romuald.bergerie (Postfix) with SMTP id A9D02160CD29; Sun, 14 Aug 2016 15:38:39 +0200 (CEST) Received: by radicelle.bergerie (sSMTP sendmail emulation); Sun, 14 Aug 2016 15:38:39 +0200 From: =?UTF-8?q?Vincent=20Stehl=C3=A9?= To: netdev@vger.kernel.org Cc: linux-kernel@vger.kernel.org, =?UTF-8?q?Vincent=20Stehl=C3=A9?= , Jiri Pirko Subject: [PATCH] mlxsw: spectrum_router: Fix use after free Date: Sun, 14 Aug 2016 15:38:29 +0200 Message-Id: <1471181909-22187-1-git-send-email-vincent.stehle@laposte.net> X-Mailer: git-send-email 2.8.1 MIME-Version: 1.0 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org In mlxsw_sp_router_fib4_add_info_destroy(), the fib_entry pointer is used after it has been freed by mlxsw_sp_fib_entry_destroy(). Use a temporary variable to fix this. Fixes: 61c503f976b5449e ("mlxsw: spectrum_router: Implement fib4 add/del switchdev obj ops") Signed-off-by: Vincent Stehlé Cc: Jiri Pirko Acked-by: Ido Schimmel --- drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c index 81418d6..90bb93b 100644 --- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c +++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c @@ -1651,9 +1651,10 @@ static void mlxsw_sp_router_fib4_add_info_destroy(void const *data) const struct mlxsw_sp_router_fib4_add_info *info = data; struct mlxsw_sp_fib_entry *fib_entry = info->fib_entry; struct mlxsw_sp *mlxsw_sp = info->mlxsw_sp; + struct mlxsw_sp_vr *vr = fib_entry->vr; mlxsw_sp_fib_entry_destroy(fib_entry); - mlxsw_sp_vr_put(mlxsw_sp, fib_entry->vr); + mlxsw_sp_vr_put(mlxsw_sp, vr); kfree(info); }