From 81d4d7289a6b8120d118f46c5182dbb86dca8436 Mon Sep 17 00:00:00 2001 From: Ido Schimmel Date: Mon, 28 Nov 2016 18:01:25 +0100 Subject: [PATCH] mlxsw: core: Add missing rollback in error path Without this rollback, the thermal zone is still registered during the error path, whereas its private data is freed upon the destruction of the underlying bus device due to the use of devm_kzalloc(). This results in use after free. Fix this by calling mlxsw_thermal_fini() from the appropriate place in the error path. Fixes: a50c1e35650b ("mlxsw: core: Implement thermal zone") Signed-off-by: Ido Schimmel Signed-off-by: Jiri Pirko Signed-off-by: David S. Miller --- drivers/net/ethernet/mellanox/mlxsw/core.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/ethernet/mellanox/mlxsw/core.c b/drivers/net/ethernet/mellanox/mlxsw/core.c index b21f88c66d1d..7a0ad39f2d0a 100644 --- a/drivers/net/ethernet/mellanox/mlxsw/core.c +++ b/drivers/net/ethernet/mellanox/mlxsw/core.c @@ -1157,6 +1157,7 @@ int mlxsw_core_bus_device_register(const struct mlxsw_bus_info *mlxsw_bus_info, if (mlxsw_core->driver->fini) mlxsw_core->driver->fini(mlxsw_core); err_driver_init: + mlxsw_thermal_fini(mlxsw_core->thermal); err_thermal_init: err_hwmon_init: devlink_unregister(devlink); -- GitLab