sfc: fix a double-free bug in efx_probe_filters
[ Upstream commit d5a306ae ] In efx_probe_filters, the channel->rps_flow_id is freed in a efx_for_each_channel marco when success equals to 0. However, after the following call chain: ef100_net_open |-> efx_probe_filters |-> ef100_net_stop |-> efx_remove_filters The channel->rps_flow_id is freed again in the efx_for_each_channel of efx_remove_filters, triggering a double-free bug. Fixes: a9dc3d56 ("sfc_ef100: RX filter table management and related gubbins") Reviewed-by:Simon Horman <horms@kernel.org> Reviewed-by:
Edward Cree <ecree.xilinx@gmail.com> Signed-off-by:
Zhipeng Lu <alexious@zju.edu.cn> Link: https://lore.kernel.org/r/20231225112915.3544581-1-alexious@zju.edu.cn Signed-off-by:
Jakub Kicinski <kuba@kernel.org> Signed-off-by:
Sasha Levin <sashal@kernel.org>
parent
cb69cad4
Please register or sign in to comment