Unverified Commit 16e09ea7 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!8613 CVE-2024-35854 

Merge Pull Request from: @ci-robot 
 
PR sync from: Zhang Changzhong <zhangchangzhong@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/FMOCSIRC6X4WYG5ARWMBJEYPCCDOW3QQ/ 
Ido Schimmel (2):
  mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash
  mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work


-- 
2.9.5
 
https://gitee.com/src-openeuler/kernel/issues/I9Q9HR 
 
Link:https://gitee.com/openeuler/kernel/pulls/8613

 

Reviewed-by: default avatarYue Haibing <yuehaibing@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parents 845f2e4e e8401bbe

drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c

+6 −1
Original line number Diff line number Diff line
@@ -829,10 +829,14 @@ mlxsw_sp_acl_tcam_vregion_destroy(struct mlxsw_sp *mlxsw_sp, 
	struct mlxsw_sp_acl_tcam *tcam = vregion->tcam;



	if (vgroup->vregion_rehash_enabled && ops->region_rehash_hints_get) {

		struct mlxsw_sp_acl_tcam_rehash_ctx *ctx = &vregion->rehash.ctx;



		mutex_lock(&tcam->lock);

		list_del(&vregion->tlist);

		mutex_unlock(&tcam->lock);

		cancel_delayed_work_sync(&vregion->rehash.dw);

		if (cancel_delayed_work_sync(&vregion->rehash.dw) &&

		    ctx->hints_priv)

			ops->region_rehash_hints_put(ctx->hints_priv);

	}

	mlxsw_sp_acl_tcam_vgroup_vregion_detach(mlxsw_sp, vregion);

	if (vregion->region2)
@@ -1502,6 +1506,7 @@ mlxsw_sp_acl_tcam_vregion_rehash(struct mlxsw_sp *mlxsw_sp, 
						ctx, credits);

	if (err) {

		dev_err(mlxsw_sp->bus_info->dev, "Failed to migrate vregion\n");

		return;

	}



	if (*credits >= 0)