mlxsw: core: Fix use-after-free calling devl_unlock() in mlxsw_core_bus_device_unregister()

Do devl_unlock() before freeing the devlink in
mlxsw_core_bus_device_unregister() function.

Reported-by: Ido Schimmel <idosch@nvidia.com>
Fixes: 72a4c8c94e ("mlxsw: convert driver to use unlocked devlink API during init/fini")
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://lore.kernel.org/r/20220721142424.3975704-1-jiri@resnulli.us
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Jiri Pirko 2022-07-21 16:24:24 +02:00 committed by Jakub Kicinski
parent 949d6b405e
commit 1b5995e370
1 changed files with 2 additions and 2 deletions

View File

@ -2296,8 +2296,8 @@ void mlxsw_core_bus_device_unregister(struct mlxsw_core *mlxsw_core,
devl_resources_unregister(devlink);
mlxsw_core->bus->fini(mlxsw_core->bus_priv);
if (!reload) {
devlink_free(devlink);
devl_unlock(devlink);
devlink_free(devlink);
}
return;
@ -2305,8 +2305,8 @@ void mlxsw_core_bus_device_unregister(struct mlxsw_core *mlxsw_core,
reload_fail_deinit:
mlxsw_core_params_unregister(mlxsw_core);
devl_resources_unregister(devlink);
devlink_free(devlink);
devl_unlock(devlink);
devlink_free(devlink);
}
EXPORT_SYMBOL(mlxsw_core_bus_device_unregister);