From 1b5995e370e4024e7bb7408247363e8e67f0393d Mon Sep 17 00:00:00 2001 From: Jiri Pirko Date: Thu, 21 Jul 2022 16:24:24 +0200 Subject: [PATCH] mlxsw: core: Fix use-after-free calling devl_unlock() in mlxsw_core_bus_device_unregister() Do devl_unlock() before freeing the devlink in mlxsw_core_bus_device_unregister() function. Reported-by: Ido Schimmel Fixes: 72a4c8c94efa ("mlxsw: convert driver to use unlocked devlink API during init/fini") Signed-off-by: Jiri Pirko Reviewed-by: Ido Schimmel Link: https://lore.kernel.org/r/20220721142424.3975704-1-jiri@resnulli.us Signed-off-by: Jakub Kicinski --- drivers/net/ethernet/mellanox/mlxsw/core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlxsw/core.c b/drivers/net/ethernet/mellanox/mlxsw/core.c index 61eb96b..1b61bc8 100644 --- a/drivers/net/ethernet/mellanox/mlxsw/core.c +++ b/drivers/net/ethernet/mellanox/mlxsw/core.c @@ -2296,8 +2296,8 @@ void mlxsw_core_bus_device_unregister(struct mlxsw_core *mlxsw_core, devl_resources_unregister(devlink); mlxsw_core->bus->fini(mlxsw_core->bus_priv); if (!reload) { - devlink_free(devlink); devl_unlock(devlink); + devlink_free(devlink); } return; @@ -2305,8 +2305,8 @@ void mlxsw_core_bus_device_unregister(struct mlxsw_core *mlxsw_core, reload_fail_deinit: mlxsw_core_params_unregister(mlxsw_core); devl_resources_unregister(devlink); - devlink_free(devlink); devl_unlock(devlink); + devlink_free(devlink); } EXPORT_SYMBOL(mlxsw_core_bus_device_unregister); -- 2.7.4