| From 898ad50ee66b3aea06da22ea2d850d16dce9eb7e Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Mon, 26 Apr 2021 07:06:14 -0700 |
| Subject: RDMA/bnxt_re: Fix a double free in bnxt_qplib_alloc_res |
| |
| From: Lv Yunlong <lyl2019@mail.ustc.edu.cn> |
| |
| [ Upstream commit 34b39efa5ae82fc0ad0acc27653c12a56328dbbe ] |
| |
| In bnxt_qplib_alloc_res, it calls bnxt_qplib_alloc_dpi_tbl(). Inside |
| bnxt_qplib_alloc_dpi_tbl, dpit->dbr_bar_reg_iomem is freed via |
| pci_iounmap() in unmap_io error branch. After the callee returns err code, |
| bnxt_qplib_alloc_res calls |
| bnxt_qplib_free_res()->bnxt_qplib_free_dpi_tbl() in the fail branch. Then |
| dpit->dbr_bar_reg_iomem is freed in the second time by pci_iounmap(). |
| |
| My patch set dpit->dbr_bar_reg_iomem to NULL after it is freed by |
| pci_iounmap() in the first time, to avoid the double free. |
| |
| Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver") |
| Link: https://lore.kernel.org/r/20210426140614.6722-1-lyl2019@mail.ustc.edu.cn |
| Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn> |
| Reviewed-by: Leon Romanovsky <leonro@nvidia.com> |
| Acked-by: Devesh Sharma <devesh.sharma@broadcom.com> |
| Signed-off-by: Jason Gunthorpe <jgg@nvidia.com> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/infiniband/hw/bnxt_re/qplib_res.c | 1 + |
| 1 file changed, 1 insertion(+) |
| |
| diff --git a/drivers/infiniband/hw/bnxt_re/qplib_res.c b/drivers/infiniband/hw/bnxt_re/qplib_res.c |
| index fa7878336100..3ca47004b752 100644 |
| --- a/drivers/infiniband/hw/bnxt_re/qplib_res.c |
| +++ b/drivers/infiniband/hw/bnxt_re/qplib_res.c |
| @@ -854,6 +854,7 @@ static int bnxt_qplib_alloc_dpi_tbl(struct bnxt_qplib_res *res, |
| |
| unmap_io: |
| pci_iounmap(res->pdev, dpit->dbr_bar_reg_iomem); |
| + dpit->dbr_bar_reg_iomem = NULL; |
| return -ENOMEM; |
| } |
| |
| -- |
| 2.30.2 |
| |
