diff options
| author | Maor Gottlieb <maorg@mellanox.com> | 2017-08-23 17:50:03 +0300 |
|---|---|---|
| committer | Saeed Mahameed <saeedm@mellanox.com> | 2017-09-26 20:52:00 +0300 |
| commit | 800350a3f145010c353bd7425428c05ac5cfc26a (patch) | |
| tree | c400118016e92f7c0786483f5295ea78af495026 /drivers/net/ethernet | |
| parent | b92af5a72ca982f0aa3df22f57a178aa5b0f4357 (diff) | |
| download | linux-800350a3f145010c353bd7425428c05ac5cfc26a.tar.xz | |
net/mlx5: Avoid NULL pointer dereference on steering cleanup
On cleanup, when the node is the last child of parent then it calls to
tree_put_node on the parent, if the parent's reference count
is decremented to 0 (for e.g. when deleting last destination of FTE)
then we free the parent as well and vice versa. In such a case
we will try to free the parent node again.
Increment the parent reference count before cleaning it's children
will prevent implicit release of the parent object.
Fixes: 0da2d66666d3 ('net/mlx5: Properly remove all steering objects')
signed-off-by: Maor Gottlieb <maorg@mellanox.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
Diffstat (limited to 'drivers/net/ethernet')
| -rw-r--r-- | drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c index 6ffe9251bf62..f390828d8728 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c @@ -2068,8 +2068,10 @@ static void clean_tree(struct fs_node *node) struct fs_node *iter; struct fs_node *temp; + tree_get_node(node); list_for_each_entry_safe(iter, temp, &node->children, list) clean_tree(iter); + tree_put_node(node); tree_remove_node(node); } } |