From a805232525970ba7fbdd75a14a84fdb0284c2286 Mon Sep 17 00:00:00 2001 From: Chiqijun Date: Thu, 10 Mar 2022 22:52:52 +0800 Subject: [PATCH] net/hinic: Fix double free issue driver inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I4WWH4 CVE: NA ----------------------------------------------------------------------- When hinic_remove is executed concurrently, chip_node is double freed. Signed-off-by: Chiqijun Reviewed-by: Wangxiaoyun Acked-by: Xie XiuQi Signed-off-by: Zheng Zengkai --- drivers/net/ethernet/huawei/hinic/hinic_lld.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/net/ethernet/huawei/hinic/hinic_lld.c b/drivers/net/ethernet/huawei/hinic/hinic_lld.c index 6c960cecf101..bea0c7ef51e8 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_lld.c +++ b/drivers/net/ethernet/huawei/hinic/hinic_lld.c @@ -119,6 +119,7 @@ struct hinic_pcidev { bool nic_des_enable; struct timer_list syncfw_time_timer; + int card_id; }; #define HINIC_EVENT_PROCESS_TIMEOUT 10000 @@ -2099,6 +2100,9 @@ static void free_chip_node(struct hinic_pcidev *pci_adapter) u32 id; int err; + if (!(card_bit_map & BIT(pci_adapter->card_id))) + return; + if (list_empty(&chip_node->func_list)) { list_del(&chip_node->node); sdk_info(&pci_adapter->pcidev->dev, @@ -2701,6 +2705,9 @@ static int hinic_probe(struct pci_dev *pdev, const struct pci_device_id *id) goto alloc_chip_node_fail; } + sscanf(pci_adapter->chip_node->chip_name, HINIC_CHIP_NAME "%d", + &pci_adapter->card_id); + err = nictool_k_init(); if (err) { sdk_warn(&pdev->dev, "Failed to init nictool"); -- GitLab