Commit af871943 authored by Shay Drory's avatar Shay Drory Committed by Saeed Mahameed

net/mlx5: Devcom, fix error flow in mlx5_devcom_register_device

In case devcom allocation is failed, mlx5 is always freeing the priv.
However, this priv might have been allocated by a different thread,
and freeing it might lead to use-after-free bugs.
Fix it by freeing the priv only in case it was allocated by the
running thread.

Fixes: fadd59fc ("net/mlx5: Introduce inter-device communication mechanism")
Signed-off-by: default avatarShay Drory <shayd@nvidia.com>
Signed-off-by: default avatarSaeed Mahameed <saeedm@nvidia.com>
parent 8c253dfc
...@@ -112,7 +112,8 @@ struct mlx5_devcom *mlx5_devcom_register_device(struct mlx5_core_dev *dev) ...@@ -112,7 +112,8 @@ struct mlx5_devcom *mlx5_devcom_register_device(struct mlx5_core_dev *dev)
priv->devs[idx] = dev; priv->devs[idx] = dev;
devcom = mlx5_devcom_alloc(priv, idx); devcom = mlx5_devcom_alloc(priv, idx);
if (!devcom) { if (!devcom) {
kfree(priv); if (new_priv)
kfree(priv);
return ERR_PTR(-ENOMEM); return ERR_PTR(-ENOMEM);
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment