From patchwork Tue Jan 22 15:57:23 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eran Ben Elisha X-Patchwork-Id: 1029358 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming-netdev@ozlabs.org Delivered-To: patchwork-incoming-netdev@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=mellanox.com Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 43kY3H6cL7z9sBn for ; Wed, 23 Jan 2019 02:57:47 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729360AbfAVP5q (ORCPT ); Tue, 22 Jan 2019 10:57:46 -0500 Received: from mail-il-dmz.mellanox.com ([193.47.165.129]:35755 "EHLO mellanox.co.il" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1729314AbfAVP5n (ORCPT ); Tue, 22 Jan 2019 10:57:43 -0500 Received: from Internal Mail-Server by MTLPINE1 (envelope-from eranbe@mellanox.com) with ESMTPS (AES256-SHA encrypted); 22 Jan 2019 17:57:35 +0200 Received: from dev-l-vrt-198.mtl.labs.mlnx (dev-l-vrt-198.mtl.labs.mlnx [10.134.198.1]) by labmailer.mlnx (8.13.8/8.13.8) with ESMTP id x0MFvZq9001815; Tue, 22 Jan 2019 17:57:35 +0200 From: Eran Ben Elisha To: netdev@vger.kernel.org, Jiri Pirko , "David S. Miller" , Saeed Mahameed Cc: Moshe Shemesh , Eran Ben Elisha Subject: [PATCH net-next 6/7] devlink: Fix use-after-free at reporter destroy Date: Tue, 22 Jan 2019 17:57:23 +0200 Message-Id: <1548172644-30862-7-git-send-email-eranbe@mellanox.com> X-Mailer: git-send-email 1.8.4.3 In-Reply-To: <1548172644-30862-1-git-send-email-eranbe@mellanox.com> References: <1548172644-30862-1-git-send-email-eranbe@mellanox.com> Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Fix a bug where reporter->devlink attribute was used after the reporter was freed. Fixes: 880ee82f0313 ("devlink: Add health reporter create/destroy functionality") Signed-off-by: Eran Ben Elisha Reviewed-by: Moshe Shemesh --- net/core/devlink.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/net/core/devlink.c b/net/core/devlink.c index 379ebd3f9a59..3cb74694de86 100644 --- a/net/core/devlink.c +++ b/net/core/devlink.c @@ -4150,12 +4150,14 @@ EXPORT_SYMBOL_GPL(devlink_health_reporter_create); void devlink_health_reporter_destroy(struct devlink_health_reporter *reporter) { - mutex_lock(&reporter->devlink->lock); + struct devlink *devlink = reporter->devlink; + + mutex_lock(&devlink->lock); list_del(&reporter->list); if (reporter->dump_msg_ctx) devlink_msg_ctx_free(reporter->dump_msg_ctx); kfree(reporter); - mutex_unlock(&reporter->devlink->lock); + mutex_unlock(&devlink->lock); } EXPORT_SYMBOL_GPL(devlink_health_reporter_destroy);