Commit af871943 authored by Shay Drory's avatar Shay Drory Committed by Saeed Mahameed
Browse files

net/mlx5: Devcom, fix error flow in mlx5_devcom_register_device 



In case devcom allocation is failed, mlx5 is always freeing the priv.
However, this priv might have been allocated by a different thread,
and freeing it might lead to use-after-free bugs.
Fix it by freeing the priv only in case it was allocated by the
running thread.

Fixes: fadd59fc ("net/mlx5: Introduce inter-device communication mechanism")
Signed-off-by: default avatarShay Drory <shayd@nvidia.com>
Signed-off-by: default avatarSaeed Mahameed <saeedm@nvidia.com>
parent 8c253dfc

drivers/net/ethernet/mellanox/mlx5/core/lib/devcom.c

+2 −1
Original line number Diff line number Diff line
@@ -112,6 +112,7 @@ struct mlx5_devcom *mlx5_devcom_register_device(struct mlx5_core_dev *dev) 
	priv->devs[idx] = dev;

	devcom = mlx5_devcom_alloc(priv, idx);

	if (!devcom) {

		if (new_priv)

			kfree(priv);

		return ERR_PTR(-ENOMEM);

	}