All of lore.kernel.org
 help / color / mirror / Atom feed
From: Tony Nguyen <anthony.l.nguyen@intel.com>
To: davem@davemloft.net, kuba@kernel.org
Cc: Yunjian Wang <wangyunjian@huawei.com>,
	netdev@vger.kernel.org, sassmann@redhat.com,
	anthony.l.nguyen@intel.com
Subject: [PATCH net 2/5] i40e: Fix use-after-free in i40e_client_subtask()
Date: Fri,  7 May 2021 09:41:48 -0700	[thread overview]
Message-ID: <20210507164151.2878147-3-anthony.l.nguyen@intel.com> (raw)
In-Reply-To: <20210507164151.2878147-1-anthony.l.nguyen@intel.com>

From: Yunjian Wang <wangyunjian@huawei.com>

Currently the call to i40e_client_del_instance frees the object
pf->cinst, however pf->cinst->lan_info is being accessed after
the free. Fix this by adding the missing return.

Addresses-Coverity: ("Read from pointer after free")
Fixes: 7b0b1a6d0ac9 ("i40e: Disable iWARP VSI PETCP_ENA flag on netdev down events")
Signed-off-by: Yunjian Wang <wangyunjian@huawei.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
---
 drivers/net/ethernet/intel/i40e/i40e_client.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/intel/i40e/i40e_client.c b/drivers/net/ethernet/intel/i40e/i40e_client.c
index a2dba32383f6..32f3facbed1a 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_client.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_client.c
@@ -375,6 +375,7 @@ void i40e_client_subtask(struct i40e_pf *pf)
 				clear_bit(__I40E_CLIENT_INSTANCE_OPENED,
 					  &cdev->state);
 				i40e_client_del_instance(pf);
+				return;
 			}
 		}
 	}
-- 
2.26.2


  parent reply	other threads:[~2021-05-07 16:40 UTC|newest]

Thread overview: 7+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-05-07 16:41 [PATCH net 0/5][pull request] Intel Wired LAN Driver Updates 2021-05-07 Tony Nguyen
2021-05-07 16:41 ` [PATCH net 1/5] i40e: fix broken XDP support Tony Nguyen
2021-05-07 16:41 ` Tony Nguyen [this message]
2021-05-07 16:41 ` [PATCH net 3/5] i40e: fix the restart auto-negotiation after FEC modified Tony Nguyen
2021-05-07 16:41 ` [PATCH net 4/5] i40e: Fix PHY type identifiers for 2.5G and 5G adapters Tony Nguyen
2021-05-07 16:41 ` [PATCH net 5/5] i40e: Remove LLDP frame filters Tony Nguyen
2021-05-07 23:10 ` [PATCH net 0/5][pull request] Intel Wired LAN Driver Updates 2021-05-07 patchwork-bot+netdevbpf

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210507164151.2878147-3-anthony.l.nguyen@intel.com \
    --to=anthony.l.nguyen@intel.com \
    --cc=davem@davemloft.net \
    --cc=kuba@kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=sassmann@redhat.com \
    --cc=wangyunjian@huawei.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.