net: hns3: fix for use-after-free when setting ring parameter
authorYunsheng Lin <linyunsheng@huawei.com>
Fri, 9 Mar 2018 02:37:00 +0000 (10:37 +0800)
committerDavid S. Miller <davem@davemloft.net>
Fri, 9 Mar 2018 16:33:14 +0000 (11:33 -0500)
commitec77789032c0d5ab77c32abd762f5a8e65198e1b
tree628ce30330ce1d663037ccd7d6bc557ef47eddcb
parentf31c1ba6687ea00a4149d6557820e02470e1dcb8
net: hns3: fix for use-after-free when setting ring parameter

In hns3_set_ringparam, hns3_uninit_all_ring frees the
memory pointed by priv->ring_data[i].ring, and
hns3_change_all_ring_bd_num use that pointer without mallocing,
which will cause a use-after-free problem.

The patch fixes it by not freeing the memory in
hns3_uninit_all_ring, and uses hns3_put_ring_config to free it
when necessary.

Signed-off-by: Yunsheng Lin <linyunsheng@huawei.com>
Signed-off-by: Peng Li <lipeng321@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
drivers/net/ethernet/hisilicon/hns3/hns3_enet.c