From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.0 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_PASS,UNPARSEABLE_RELAY, URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id A241AC282C3 for ; Tue, 22 Jan 2019 15:57:47 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 7CF97217D8 for ; Tue, 22 Jan 2019 15:57:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729360AbfAVP5q (ORCPT ); Tue, 22 Jan 2019 10:57:46 -0500 Received: from mail-il-dmz.mellanox.com ([193.47.165.129]:35755 "EHLO mellanox.co.il" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1729314AbfAVP5n (ORCPT ); Tue, 22 Jan 2019 10:57:43 -0500 Received: from Internal Mail-Server by MTLPINE1 (envelope-from eranbe@mellanox.com) with ESMTPS (AES256-SHA encrypted); 22 Jan 2019 17:57:35 +0200 Received: from dev-l-vrt-198.mtl.labs.mlnx (dev-l-vrt-198.mtl.labs.mlnx [10.134.198.1]) by labmailer.mlnx (8.13.8/8.13.8) with ESMTP id x0MFvZq9001815; Tue, 22 Jan 2019 17:57:35 +0200 From: Eran Ben Elisha To: netdev@vger.kernel.org, Jiri Pirko , "David S. Miller" , Saeed Mahameed Cc: Moshe Shemesh , Eran Ben Elisha Subject: [PATCH net-next 6/7] devlink: Fix use-after-free at reporter destroy Date: Tue, 22 Jan 2019 17:57:23 +0200 Message-Id: <1548172644-30862-7-git-send-email-eranbe@mellanox.com> X-Mailer: git-send-email 1.8.4.3 In-Reply-To: <1548172644-30862-1-git-send-email-eranbe@mellanox.com> References: <1548172644-30862-1-git-send-email-eranbe@mellanox.com> Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Fix a bug where reporter->devlink attribute was used after the reporter was freed. Fixes: 880ee82f0313 ("devlink: Add health reporter create/destroy functionality") Signed-off-by: Eran Ben Elisha Reviewed-by: Moshe Shemesh --- net/core/devlink.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/net/core/devlink.c b/net/core/devlink.c index 379ebd3f9a59..3cb74694de86 100644 --- a/net/core/devlink.c +++ b/net/core/devlink.c @@ -4150,12 +4150,14 @@ EXPORT_SYMBOL_GPL(devlink_health_reporter_create); void devlink_health_reporter_destroy(struct devlink_health_reporter *reporter) { - mutex_lock(&reporter->devlink->lock); + struct devlink *devlink = reporter->devlink; + + mutex_lock(&devlink->lock); list_del(&reporter->list); if (reporter->dump_msg_ctx) devlink_msg_ctx_free(reporter->dump_msg_ctx); kfree(reporter); - mutex_unlock(&reporter->devlink->lock); + mutex_unlock(&devlink->lock); } EXPORT_SYMBOL_GPL(devlink_health_reporter_destroy); -- 2.17.1