提交 5114a04e 编写于 作者: C Carol L Soto 提交者: David S. Miller

net/mlx4_core: double free of dev_vfs

If user loads mlx4_core with num_vfs greater than
supported then variable dev->dev_vfs is freed 2 times after unloading the
driver.
Acked-by: NOr Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: NCarol L Soto <clsoto@linux.vnet.ibm.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
上级 e1395a32
......@@ -2824,6 +2824,7 @@ static u64 mlx4_enable_sriov(struct mlx4_dev *dev, struct pci_dev *pdev,
free_mem:
dev->persist->num_vfs = 0;
kfree(dev->dev_vfs);
dev->dev_vfs = NULL;
return dev_flags & ~MLX4_FLAG_MASTER;
}
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册