Skip to content
Commit d007caaa authored by Dinghao Liu's avatar Dinghao Liu Committed by Jakub Kicinski
Browse files

net: bnxt: fix a potential use-after-free in bnxt_init_tc

When flow_indr_dev_register() fails, bnxt_init_tc will free
bp->tc_info through kfree(). However, the caller function
bnxt_init_one() will ignore this failure and call
bnxt_shutdown_tc() on failure of bnxt_dl_register(), where
a use-after-free happens. Fix this issue by setting
bp->tc_info to NULL after kfree().

Fixes: 627c89d0

 ("bnxt_en: flow_offload: offload tunnel decap rules via indirect callbacks")
Signed-off-by: default avatarDinghao Liu <dinghao.liu@zju.edu.cn>
Reviewed-by: default avatarPavan Chebbi <pavan.chebbi@broadcom.com>
Reviewed-by: default avatarMichael Chan <michael.chan@broadcom.com>
Reviewed-by: default avatarSomnath Kotur <somnath.kotur@broadcom.com>
Link: https://lore.kernel.org/r/20231204024004.8245-1-dinghao.liu@zju.edu.cn


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent a61f46e1
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment