[bug report] net/mlx5: Move esw multiport devlink param to eswitch code

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hello Shay Drory,

The patch 3f90840305e2: "net/mlx5: Move esw multiport devlink param
to eswitch code" from May 17, 2023, leads to the following Smatch
static checker warning:

	drivers/net/ethernet/mellanox/mlx5/core/eswitch.c:1848 mlx5_eswitch_cleanup()
	error: dereferencing freed memory 'esw'

drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
    1828 void mlx5_eswitch_cleanup(struct mlx5_eswitch *esw)
    1829 {
    1830         if (!esw)
    1831                 return;
    1832 
    1833         esw_info(esw->dev, "cleanup\n");
    1834 
    1835         esw->dev->priv.eswitch = NULL;
    1836         destroy_workqueue(esw->work_queue);
    1837         WARN_ON(refcount_read(&esw->qos.refcnt));
    1838         mutex_destroy(&esw->state_lock);
    1839         WARN_ON(!xa_empty(&esw->offloads.vhca_map));
    1840         xa_destroy(&esw->offloads.vhca_map);
    1841         ida_destroy(&esw->offloads.vport_metadata_ida);
    1842         mlx5e_mod_hdr_tbl_destroy(&esw->offloads.mod_hdr);
    1843         mutex_destroy(&esw->offloads.encap_tbl_lock);
    1844         mutex_destroy(&esw->offloads.decap_tbl_lock);
    1845         esw_offloads_cleanup(esw);
    1846         mlx5_esw_vports_cleanup(esw);
    1847         kfree(esw);
                       ^^^
Free.

--> 1848         devl_params_unregister(priv_to_devlink(esw->dev), mlx5_eswitch_params,
                                                        ^^^^^^^^
Use after free.

    1849                                ARRAY_SIZE(mlx5_eswitch_params));
    1850 }

regards,
dan carpenter



[Index of Archives]     [Kernel Development]     [Kernel Announce]     [Kernel Newbies]     [Linux Networking Development]     [Share Photos]     [IDE]     [Security]     [Git]     [Netfilter]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Device Mapper]

  Powered by Linux