diff options
| author | Dinghao Liu <[email protected]> | 2023-12-10 04:52:55 +0000 |
|---|---|---|
| committer | Jakub Kicinski <[email protected]> | 2023-12-12 21:33:51 +0000 |
| commit | b65d52ac9c085c0c52dee012a210d4e2f352611b (patch) | |
| tree | fc177a28dc429e8351674b754af147ad9c9beafd /net/ipv4/tcp_output.c | |
| parent | net/rose: Fix Use-After-Free in rose_ioctl (diff) | |
| download | kernel-b65d52ac9c085c0c52dee012a210d4e2f352611b.tar.gz kernel-b65d52ac9c085c0c52dee012a210d4e2f352611b.zip | |
qed: Fix a potential use-after-free in qed_cxt_tables_alloc
qed_ilt_shadow_alloc() will call qed_ilt_shadow_free() to
free p_hwfn->p_cxt_mngr->ilt_shadow on error. However,
qed_cxt_tables_alloc() accesses the freed pointer on failure
of qed_ilt_shadow_alloc() through calling qed_cxt_mngr_free(),
which may lead to use-after-free. Fix this issue by setting
p_mngr->ilt_shadow to NULL in qed_ilt_shadow_free().
Fixes: fe56b9e6a8d9 ("qed: Add module with basic common support")
Reviewed-by: Przemek Kitszel <[email protected]>
Signed-off-by: Dinghao Liu <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Jakub Kicinski <[email protected]>
Diffstat (limited to 'net/ipv4/tcp_output.c')
0 files changed, 0 insertions, 0 deletions