Commit 467ee38

committed

ON-16252: Fix ef10ct pci_dev use after free

Increment refcount of ef10ct pci_dev in ef10ct_get_pci_dev as required by efhw function interface. Care is taken to do this while auxbus is present otherwise the pci device may have already been freed by the sfc-linux-net.

1 parent 6e4cd22 commit 467ee38Copy full SHA for 467ee38

File tree

1 file changed

-0

lines changed

src/lib/efhw/ef10ct
- ef10ct.c

1 file changed

-0

lines changed

`‎src/lib/efhw/ef10ct/ef10ct.c‎`

Lines changed: 5 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -1069,6 +1069,11 @@ ef10ct_get_pci_dev(struct efhw_nic* nic)`
`1069`	`1069`
`1070`	`1070`	`AUX_PRE(dev, edev, cli, nic, rc)`
`1071`	`1071`	`rc = edev->llct_ops->base_ops->get_param(cli, EFX_PCI_DEV, &val);`
	`1072`	`+ /* Ensure auxbus is still present when we increment the refcount to the pci`
	`1073`	`+ * dev. This means it will not be used after free. */`
	`1074`	`+ if( rc >= 0 )`
	`1075`	`+ pci_dev_get(val.pci_dev);`
	`1076`	`+`
`1072`	`1077`	`AUX_POST(dev, edev, cli, nic, rc);`
`1073`	`1078`
`1074`	`1079`	`if( rc < 0 )`

0 commit comments

Comments

(0)

Navigation Menu

Search code, repositories, users, issues, pull requests...

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Commit 467ee38

File tree

1 file changed

1 file changed

`‎src/lib/efhw/ef10ct/ef10ct.c‎`

0 commit comments