mlxsw: core: Fix use-after-free calling devl_unlock() in mlxsw_core_bus_device_unregister()
Do devl_unlock() before freeing the devlink in
mlxsw_core_bus_device_unregister() function.
Reported-by: Ido Schimmel <idosch@nvidia.com>
Fixes: 72a4c8c94e
("mlxsw: convert driver to use unlocked devlink API during init/fini")
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://lore.kernel.org/r/20220721142424.3975704-1-jiri@resnulli.us
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
parent
949d6b405e
commit
1b5995e370
|
@ -2296,8 +2296,8 @@ void mlxsw_core_bus_device_unregister(struct mlxsw_core *mlxsw_core,
|
|||
devl_resources_unregister(devlink);
|
||||
mlxsw_core->bus->fini(mlxsw_core->bus_priv);
|
||||
if (!reload) {
|
||||
devlink_free(devlink);
|
||||
devl_unlock(devlink);
|
||||
devlink_free(devlink);
|
||||
}
|
||||
|
||||
return;
|
||||
|
@ -2305,8 +2305,8 @@ void mlxsw_core_bus_device_unregister(struct mlxsw_core *mlxsw_core,
|
|||
reload_fail_deinit:
|
||||
mlxsw_core_params_unregister(mlxsw_core);
|
||||
devl_resources_unregister(devlink);
|
||||
devlink_free(devlink);
|
||||
devl_unlock(devlink);
|
||||
devlink_free(devlink);
|
||||
}
|
||||
EXPORT_SYMBOL(mlxsw_core_bus_device_unregister);
|
||||
|
||||
|
|
Loading…
Reference in New Issue