qlcnic: prevent ->dcb use-after-free on qlcnic_dcb_enable() failure

Browse source

[ Upstream commit 13a7c8964a ]

adapter->dcb would get silently freed inside qlcnic_dcb_enable() in
case qlcnic_dcb_attach() would return an error, which always happens
under OOM conditions. This would lead to use-after-free because both
of the existing callers invoke qlcnic_dcb_get_info() on the obtained
pointer, which is potentially freed at that point.

Propagate errors from qlcnic_dcb_enable(), and instead free the dcb
pointer at callsite using qlcnic_dcb_free(). This also removes the now
unused qlcnic_clear_dcb_ops() helper, which was a simple wrapper around
kfree() also causing memory leaks for partially initialized dcb.

Found by Linux Verification Center (linuxtesting.org) with the SVACE
static analysis tool.

Fixes: 3c44bba1d2 ("qlcnic: Disable DCB operations from SR-IOV VFs")
Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
Signed-off-by: Daniil Tatianin <d-tatianin@yandex-team.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>

...

This commit is contained in:

Daniil Tatianin 2022-12-22 14:52:28 +03:00 • committed by Greg Kroah-Hartman

parent facc4405e8

commit a2a694e6ed

3 changed files with 16 additions and 10 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

8

drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c

View file

10

drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.h

View file

8

drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c

View file