提交 371c2b34 编写于 作者: D Dan Carpenter 提交者: Saeed Mahameed

net/mlx5e: TC, Fix use after free in mlx5e_clone_flow_attr_for_post_act()

This returns freed memory leading to a use after free.  It's supposed to
return NULL.

Fixes: 8300f225 ("net/mlx5e: Create new flow attr for multi table actions")
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: NRoi Dayan <roid@nvidia.com>
Signed-off-by: NSaeed Mahameed <saeedm@nvidia.com>
上级 24055bb8
...@@ -3410,7 +3410,7 @@ mlx5e_clone_flow_attr_for_post_act(struct mlx5_flow_attr *attr, ...@@ -3410,7 +3410,7 @@ mlx5e_clone_flow_attr_for_post_act(struct mlx5_flow_attr *attr,
if (!attr2 || !parse_attr) { if (!attr2 || !parse_attr) {
kvfree(parse_attr); kvfree(parse_attr);
kfree(attr2); kfree(attr2);
return attr2; return NULL;
} }
memcpy(attr2, attr, attr_sz); memcpy(attr2, attr, attr_sz);
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册