| From 9cc4db84ec2a40e03d4922b564479922fc88f23f Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Mon, 12 Apr 2021 22:41:18 +0800 |
| Subject: i40e: Fix use-after-free in i40e_client_subtask() |
| |
| From: Yunjian Wang <wangyunjian@huawei.com> |
| |
| [ Upstream commit 38318f23a7ef86a8b1862e5e8078c4de121960c3 ] |
| |
| Currently the call to i40e_client_del_instance frees the object |
| pf->cinst, however pf->cinst->lan_info is being accessed after |
| the free. Fix this by adding the missing return. |
| |
| Addresses-Coverity: ("Read from pointer after free") |
| Fixes: 7b0b1a6d0ac9 ("i40e: Disable iWARP VSI PETCP_ENA flag on netdev down events") |
| Signed-off-by: Yunjian Wang <wangyunjian@huawei.com> |
| Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/net/ethernet/intel/i40e/i40e_client.c | 1 + |
| 1 file changed, 1 insertion(+) |
| |
| diff --git a/drivers/net/ethernet/intel/i40e/i40e_client.c b/drivers/net/ethernet/intel/i40e/i40e_client.c |
| index a2dba32383f6..32f3facbed1a 100644 |
| --- a/drivers/net/ethernet/intel/i40e/i40e_client.c |
| +++ b/drivers/net/ethernet/intel/i40e/i40e_client.c |
| @@ -375,6 +375,7 @@ void i40e_client_subtask(struct i40e_pf *pf) |
| clear_bit(__I40E_CLIENT_INSTANCE_OPENED, |
| &cdev->state); |
| i40e_client_del_instance(pf); |
| + return; |
| } |
| } |
| } |
| -- |
| 2.30.2 |
| |
