diff options
author | Dan Carpenter <dan.carpenter@oracle.com> | 2018-03-13 05:09:38 -0400 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2018-03-13 10:54:17 -0400 |
commit | f89782c2d131e6eae0d1ea2569ba76bc4c5875fe (patch) | |
tree | fe21d284efc70b90a6e58e6962d668876fa219de | |
parent | d2ddf628e90ffb92b411757eeb8655314371b879 (diff) |
qed: Use after free in qed_rdma_free()
We're dereferencing "p_hwfn->p_rdma_info" but that is freed on the line
before in qed_rdma_resc_free(p_hwfn).
Fixes: 9de506a547c0 ("qed: Free RoCE ILT Memory on rmmod qedr")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Michal Kalderon <Michal.Kalderon@cavium.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r-- | drivers/net/ethernet/qlogic/qed/qed_rdma.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/ethernet/qlogic/qed/qed_rdma.c b/drivers/net/ethernet/qlogic/qed/qed_rdma.c index f3ee6538b553..a411f9c702a1 100644 --- a/drivers/net/ethernet/qlogic/qed/qed_rdma.c +++ b/drivers/net/ethernet/qlogic/qed/qed_rdma.c | |||
@@ -379,8 +379,8 @@ static void qed_rdma_free(struct qed_hwfn *p_hwfn) | |||
379 | DP_VERBOSE(p_hwfn, QED_MSG_RDMA, "Freeing RDMA\n"); | 379 | DP_VERBOSE(p_hwfn, QED_MSG_RDMA, "Freeing RDMA\n"); |
380 | 380 | ||
381 | qed_rdma_free_reserved_lkey(p_hwfn); | 381 | qed_rdma_free_reserved_lkey(p_hwfn); |
382 | qed_rdma_resc_free(p_hwfn); | ||
383 | qed_cxt_free_proto_ilt(p_hwfn, p_hwfn->p_rdma_info->proto); | 382 | qed_cxt_free_proto_ilt(p_hwfn, p_hwfn->p_rdma_info->proto); |
383 | qed_rdma_resc_free(p_hwfn); | ||
384 | } | 384 | } |
385 | 385 | ||
386 | static void qed_rdma_get_guid(struct qed_hwfn *p_hwfn, u8 *guid) | 386 | static void qed_rdma_get_guid(struct qed_hwfn *p_hwfn, u8 *guid) |