I have a candidate fix, under internal review
On 14/06/2023 16:00, Dan Carpenter wrote:
External email: Use caution opening links or attachments
Hello Shay Drory,
The patch 3f90840305e2: "net/mlx5: Move esw multiport devlink param
to eswitch code" from May 17, 2023, leads to the following Smatch
static checker warning:
drivers/net/ethernet/mellanox/mlx5/core/eswitch.c:1848 mlx5_eswitch_cleanup()
error: dereferencing freed memory 'esw'
drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
1828 void mlx5_eswitch_cleanup(struct mlx5_eswitch *esw)
1829 {
1830 if (!esw)
1831 return;
1832
1833 esw_info(esw->dev, "cleanup\n");
1834
1835 esw->dev->priv.eswitch = NULL;
1836 destroy_workqueue(esw->work_queue);
1837 WARN_ON(refcount_read(&esw->qos.refcnt));
1838 mutex_destroy(&esw->state_lock);
1839 WARN_ON(!xa_empty(&esw->offloads.vhca_map));
1840 xa_destroy(&esw->offloads.vhca_map);
1841 ida_destroy(&esw->offloads.vport_metadata_ida);
1842 mlx5e_mod_hdr_tbl_destroy(&esw->offloads.mod_hdr);
1843 mutex_destroy(&esw->offloads.encap_tbl_lock);
1844 mutex_destroy(&esw->offloads.decap_tbl_lock);
1845 esw_offloads_cleanup(esw);
1846 mlx5_esw_vports_cleanup(esw);
1847 kfree(esw);
^^^
Free.
--> 1848 devl_params_unregister(priv_to_devlink(esw->dev), mlx5_eswitch_params,
^^^^^^^^
Use after free.
1849 ARRAY_SIZE(mlx5_eswitch_params));
1850 }
regards,
dan carpenter
