All of lore.kernel.org
 help / color / mirror / Atom feed
From: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
To: selvin.xavier@broadcom.com, devesh.sharma@broadcom.com,
	somnath.kotur@broadcom.com, sriharsha.basavapatna@broadcom.com,
	nareshkumar.pbs@broadcom.com, dledford@redhat.com, jgg@ziepe.ca
Cc: linux-rdma@vger.kernel.org, linux-kernel@vger.kernel.org,
	Lv Yunlong <lyl2019@mail.ustc.edu.cn>
Subject: [PATCH] RDMA/bnxt_re/qplib_res: Fix a double free in bnxt_qplib_alloc_res
Date: Mon, 26 Apr 2021 07:06:14 -0700	[thread overview]
Message-ID: <20210426140614.6722-1-lyl2019@mail.ustc.edu.cn> (raw)

In bnxt_qplib_alloc_res, it calls bnxt_qplib_alloc_dpi_tbl().
Inside bnxt_qplib_alloc_dpi_tbl, dpit->dbr_bar_reg_iomem is freed via
pci_iounmap() in unmap_io error branch. After the callee returns err code,
bnxt_qplib_alloc_res calls bnxt_qplib_free_res()->bnxt_qplib_free_dpi_tbl()
in fail branch. Then dpit->dbr_bar_reg_iomem is freed in the second time by
pci_iounmap().

My patch set dpit->dbr_bar_reg_iomem to NULL after it is freed by pci_iounmap()
in the first time, to avoid the double free.

Fixes: 1ac5a40479752 ("RDMA/bnxt_re: Add bnxt_re RoCE driver")
Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
---
 drivers/infiniband/hw/bnxt_re/qplib_res.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/infiniband/hw/bnxt_re/qplib_res.c b/drivers/infiniband/hw/bnxt_re/qplib_res.c
index fa7878336100..3ca47004b752 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_res.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_res.c
@@ -854,6 +854,7 @@ static int bnxt_qplib_alloc_dpi_tbl(struct bnxt_qplib_res     *res,
 
 unmap_io:
 	pci_iounmap(res->pdev, dpit->dbr_bar_reg_iomem);
+	dpit->dbr_bar_reg_iomem = NULL;
 	return -ENOMEM;
 }
 
-- 
2.25.1



             reply	other threads:[~2021-04-26 14:06 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-04-26 14:06 Lv Yunlong [this message]
2021-04-27  4:51 ` [PATCH] RDMA/bnxt_re/qplib_res: Fix a double free in bnxt_qplib_alloc_res Leon Romanovsky
2021-04-27  5:36   ` Devesh Sharma
2021-04-27 18:31 ` Jason Gunthorpe

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210426140614.6722-1-lyl2019@mail.ustc.edu.cn \
    --to=lyl2019@mail.ustc.edu.cn \
    --cc=devesh.sharma@broadcom.com \
    --cc=dledford@redhat.com \
    --cc=jgg@ziepe.ca \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-rdma@vger.kernel.org \
    --cc=nareshkumar.pbs@broadcom.com \
    --cc=selvin.xavier@broadcom.com \
    --cc=somnath.kotur@broadcom.com \
    --cc=sriharsha.basavapatna@broadcom.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.