netdev - [patch] net/mlx4_en: dereferencing freed memory

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20120711063407.GD11812@elgon.mountain>
Date:	Wed, 11 Jul 2012 09:34:07 +0300
From:	Dan Carpenter <dan.carpenter@...cle.com>
To:	Yevgeny Petrilin <yevgenyp@...lanox.co.il>
Cc:	"David S. Miller" <davem@...emloft.net>,
	Amir Vadai <amirv@...lanox.com>,
	Or Gerlitz <ogerlitz@...lanox.com>,
	Alexander Guller <alexg@...lanox.com>, netdev@...r.kernel.org,
	kernel-janitors@...r.kernel.org
Subject: [patch] net/mlx4_en: dereferencing freed memory

We dereferenced "mclist" after the kfree().

Signed-off-by: Dan Carpenter <dan.carpenter@...cle.com>

diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index 94375a8..4ce5ca8 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -503,9 +503,7 @@ static void mlx4_en_do_set_multicast(struct work_struct *work)
 				/* remove from list */
 				list_del(&mclist->list);
 				kfree(mclist);
-			}
-
-			if (mclist->action == MCLIST_ADD) {
+			} else if (mclist->action == MCLIST_ADD) {
 				/* attach the address */
 				memcpy(&mc_list[10], mclist->addr, ETH_ALEN);
 				/* needed for B0 steering support */
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html