提交 64d2c22a 编写于 作者: D Dan Carpenter 提交者: David S. Miller

mlx5: use after free in mlx5_cmd_comp_handler()

We can't dereference "ent" after passing it to free_cmd().
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
上级 4ea72445
......@@ -1113,7 +1113,13 @@ void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, unsigned long vector)
for (i = 0; i < (1 << cmd->log_sz); i++) {
if (test_bit(i, &vector)) {
struct semaphore *sem;
ent = cmd->ent_arr[i];
if (ent->page_queue)
sem = &cmd->pages_sem;
else
sem = &cmd->sem;
ktime_get_ts(&ent->ts2);
memcpy(ent->out->first.data, ent->lay->out, sizeof(ent->lay->out));
dump_command(dev, ent, 0);
......@@ -1136,10 +1142,7 @@ void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, unsigned long vector)
} else {
complete(&ent->done);
}
if (ent->page_queue)
up(&cmd->pages_sem);
else
up(&cmd->sem);
up(sem);
}
}
}
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册