diff options
| author | Dan Carpenter <dan.carpenter@linaro.org> | 2025-09-23 14:19:11 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-10-02 13:44:11 +0200 |
| commit | c41b2941a024d4ec7c768e16ffb10a74b188fced (patch) | |
| tree | 66ed864a605990b8c64f3f7ed07cbc7f5a26f97e /include/net/aligned_data.h | |
| parent | ca74b67b475b967ce4d0fb54b3e25780dc17c6fc (diff) | |
octeontx2-pf: Fix potential use after free in otx2_tc_add_flow()
[ Upstream commit d9c70e93ec5988ab07ad2a92d9f9d12867f02c56 ]
This code calls kfree_rcu(new_node, rcu) and then dereferences "new_node"
and then dereferences it on the next line. Two lines later, we take
a mutex so I don't think this is an RCU safe region. Re-order it to do
the dereferences before queuing up the free.
Fixes: 68fbff68dbea ("octeontx2-pf: Add police action for TC flower")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
Link: https://patch.msgid.link/aNKCL1jKwK8GRJHh@stanley.mountain
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'include/net/aligned_data.h')
0 files changed, 0 insertions, 0 deletions