]> git.proxmox.com Git - mirror_ubuntu-kernels.git/commitdiff
i40e: Fix use-after-free in i40e_client_subtask()
authorYunjian Wang <wangyunjian@huawei.com>
Mon, 12 Apr 2021 14:41:18 +0000 (22:41 +0800)
committerTony Nguyen <anthony.l.nguyen@intel.com>
Fri, 7 May 2021 16:35:49 +0000 (09:35 -0700)
Currently the call to i40e_client_del_instance frees the object
pf->cinst, however pf->cinst->lan_info is being accessed after
the free. Fix this by adding the missing return.

Addresses-Coverity: ("Read from pointer after free")
Fixes: 7b0b1a6d0ac9 ("i40e: Disable iWARP VSI PETCP_ENA flag on netdev down events")
Signed-off-by: Yunjian Wang <wangyunjian@huawei.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
drivers/net/ethernet/intel/i40e/i40e_client.c

index a2dba32383f638d6ddc3e5fb55f4f88ccf341942..32f3facbed1a57e15c36d37da1d520fc7e88de2a 100644 (file)
@@ -375,6 +375,7 @@ void i40e_client_subtask(struct i40e_pf *pf)
                                clear_bit(__I40E_CLIENT_INSTANCE_OPENED,
                                          &cdev->state);
                                i40e_client_del_instance(pf);
+                               return;
                        }
                }
        }