Patch "octeontx2-af: fix a use-after-free in rvu_npa_register_reporters" has been added to the 5.15-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    octeontx2-af: fix a use-after-free in rvu_npa_register_reporters

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     octeontx2-af-fix-a-use-after-free-in-rvu_npa_registe.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 3c88655de2a80da6dfeae378a5a9fa7c3959c7ed
Author: Zhipeng Lu <alexious@xxxxxxxxxx>
Date:   Sat Dec 2 17:59:02 2023 +0800

    octeontx2-af: fix a use-after-free in rvu_npa_register_reporters
    
    [ Upstream commit 3c91c909f13f0c32b0d54d75c3f798479b1a84f5 ]
    
    The rvu_dl will be freed in rvu_npa_health_reporters_destroy(rvu_dl)
    after the create_workqueue fails, and after that free, the rvu_dl will
    be translate back through rvu_npa_health_reporters_create,
    rvu_health_reporters_create, and rvu_register_dl. Finally it goes to the
    err_dl_health label, being freed again in
    rvu_health_reporters_destroy(rvu) by rvu_npa_health_reporters_destroy.
    In the second calls of rvu_npa_health_reporters_destroy, however,
    it uses rvu_dl->rvu_npa_health_reporter, which is already freed at
    the end of rvu_npa_health_reporters_destroy in the first call.
    
    So this patch prevents the first destroy by instantly returning -ENONMEN
    when create_workqueue fails. In addition, since the failure of
    create_workqueue is the only entrence of label err, it has been
    integrated into the error-handling path of create_workqueue.
    
    Fixes: f1168d1e207c ("octeontx2-af: Add devlink health reporters for NPA")
    Signed-off-by: Zhipeng Lu <alexious@xxxxxxxxxx>
    Acked-by: Paolo Abeni <pabeni@xxxxxxxxxx>
    Acked-by: Geethasowjanya Akula <gakula@xxxxxxxxxxx>
    Link: https://lore.kernel.org/r/20231202095902.3264863-1-alexious@xxxxxxxxxx
    Signed-off-by: Paolo Abeni <pabeni@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c
index 274d3abe30eb4..ba7ff776760d3 100644
--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c
+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c
@@ -1284,7 +1284,7 @@ static int rvu_npa_register_reporters(struct rvu_devlink *rvu_dl)
 
 	rvu_dl->devlink_wq = create_workqueue("rvu_devlink_wq");
 	if (!rvu_dl->devlink_wq)
-		goto err;
+		return -ENOMEM;
 
 	INIT_WORK(&rvu_reporters->intr_work, rvu_npa_intr_work);
 	INIT_WORK(&rvu_reporters->err_work, rvu_npa_err_work);
@@ -1292,9 +1292,6 @@ static int rvu_npa_register_reporters(struct rvu_devlink *rvu_dl)
 	INIT_WORK(&rvu_reporters->ras_work, rvu_npa_ras_work);
 
 	return 0;
-err:
-	rvu_npa_health_reporters_destroy(rvu_dl);
-	return -ENOMEM;
 }
 
 static int rvu_npa_health_reporters_create(struct rvu_devlink *rvu_dl)




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux