Commit 3b914d9d authored by Chiqijun's avatar Chiqijun Committed by Zheng Zengkai
Browse files

net/hinic: Fix double free issue 

driver inclusion
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I4WWH4


CVE: NA

-----------------------------------------------------------------------

When hinic_remove is executed concurrently, chip_node is double freed.

Signed-off-by: default avatarChiqijun <chiqijun@huawei.com>
Reviewed-by: default avatarWangxiaoyun <cloud.wangxiaoyun@huawei.com>
Acked-by: default avatarXie XiuQi <xiexiuqi@huawei.com>
Signed-off-by: default avatarZheng Zengkai <zhengzengkai@huawei.com>
parent 1dd5afe8

drivers/net/ethernet/huawei/hinic/hinic_lld.c

+7 −0
Original line number Diff line number Diff line
@@ -119,6 +119,7 @@ struct hinic_pcidev { 
	bool nic_des_enable;



	struct timer_list syncfw_time_timer;

	int card_id;

};



#define HINIC_EVENT_PROCESS_TIMEOUT	10000
@@ -2099,6 +2100,9 @@ static void free_chip_node(struct hinic_pcidev *pci_adapter) 
	u32 id;

	int err;



	if (!(card_bit_map & BIT(pci_adapter->card_id)))

		return;



	if (list_empty(&chip_node->func_list)) {

		list_del(&chip_node->node);

		sdk_info(&pci_adapter->pcidev->dev,
@@ -2701,6 +2705,9 @@ static int hinic_probe(struct pci_dev *pdev, const struct pci_device_id *id) 
		goto alloc_chip_node_fail;

	}



	sscanf(pci_adapter->chip_node->chip_name, HINIC_CHIP_NAME "%d",

	       &pci_adapter->card_id);



	err = nictool_k_init();

	if (err) {

		sdk_warn(&pdev->dev, "Failed to init nictool");