diff options
| author | Saeed Mahameed <saeedm@mellanox.com> | 2019-03-20 06:09:05 +0100 |
|---|---|---|
| committer | Saeed Mahameed <saeedm@mellanox.com> | 2019-04-09 21:33:49 +0200 |
| commit | 31634bf5dcc418b5b2cacd954394c0c4620db6a2 (patch) | |
| tree | 120b30a5b675b1247551ca974529946d24ba76bd /drivers/net | |
| parent | Merge tag 'mac80211-for-davem-2019-04-09' of git://git.kernel.org/pub/scm/lin... (diff) | |
| download | linux-31634bf5dcc418b5b2cacd954394c0c4620db6a2.tar.xz linux-31634bf5dcc418b5b2cacd954394c0c4620db6a2.zip | |
net/mlx5: FPGA, tls, hold rcu read lock a bit longer
To avoid use-after-free, hold the rcu read lock until we are done copying
flow data into the command buffer.
Fixes: ab412e1dd7db ("net/mlx5: Accel, add TLS rx offload routines")
Reported-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
Diffstat (limited to 'drivers/net')
| -rw-r--r-- | drivers/net/ethernet/mellanox/mlx5/core/fpga/tls.c | 18 |
1 files changed, 9 insertions, 9 deletions
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fpga/tls.c b/drivers/net/ethernet/mellanox/mlx5/core/fpga/tls.c index 8de64e88c670..08aa7266c8c0 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/fpga/tls.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/fpga/tls.c @@ -217,22 +217,22 @@ int mlx5_fpga_tls_resync_rx(struct mlx5_core_dev *mdev, u32 handle, u32 seq, void *cmd; int ret; - rcu_read_lock(); - flow = idr_find(&mdev->fpga->tls->rx_idr, ntohl(handle)); - rcu_read_unlock(); - - if (!flow) { - WARN_ONCE(1, "Received NULL pointer for handle\n"); - return -EINVAL; - } - buf = kzalloc(size, GFP_ATOMIC); if (!buf) return -ENOMEM; cmd = (buf + 1); + rcu_read_lock(); + flow = idr_find(&mdev->fpga->tls->rx_idr, ntohl(handle)); + if (unlikely(!flow)) { + rcu_read_unlock(); + WARN_ONCE(1, "Received NULL pointer for handle\n"); + kfree(buf); + return -EINVAL; + } mlx5_fpga_tls_flow_to_cmd(flow, cmd); + rcu_read_unlock(); MLX5_SET(tls_cmd, cmd, swid, ntohl(handle)); MLX5_SET64(tls_cmd, cmd, tls_rcd_sn, be64_to_cpu(rcd_sn)); |