DPDK patches and discussions
 help / color / mirror / Atom feed
* [dpdk-dev] [PATCH] net/mlx5: fix use after free in mlx5_dma_unmap
@ 2021-07-10 10:35 wangyunjian
  2021-07-22 14:10 ` Thomas Monjalon
  0 siblings, 1 reply; 2+ messages in thread
From: wangyunjian @ 2021-07-10 10:35 UTC (permalink / raw)
  To: dev; +Cc: matan, shahafs, viacheslavo, dingxiaoxiong, Yunjian Wang, stable

From: Yunjian Wang <wangyunjian@huawei.com>

This patch fixes the use-after-free bug which was reported by Coverity
Scan in the mlx5_dma_unmap function.

Coverity issue: 371679
Fixes: 992e6df3dafe ("common/mlx5: free MR resource on device DMA unmap")
Cc: stable@dpdk.org

Signed-off-by: Yunjian Wang <wangyunjian@huawei.com>
---
 drivers/net/mlx5/mlx5_mr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/mlx5/mlx5_mr.c b/drivers/net/mlx5/mlx5_mr.c
index 89c43fc9e9..e87f138564 100644
--- a/drivers/net/mlx5/mlx5_mr.c
+++ b/drivers/net/mlx5/mlx5_mr.c
@@ -315,9 +315,9 @@ mlx5_dma_unmap(struct rte_pci_device *pdev, void *addr,
 		return -1;
 	}
 	LIST_REMOVE(mr, mr);
-	mlx5_mr_free(mr, sh->share_cache.dereg_mr_cb);
 	DRV_LOG(DEBUG, "port %u remove MR(%p) from list", dev->data->port_id,
 	      (void *)mr);
+	mlx5_mr_free(mr, sh->share_cache.dereg_mr_cb);
 	mlx5_mr_rebuild_cache(&sh->share_cache);
 	/*
 	 * No explicit wmb is needed after updating dev_gen due to
-- 
2.23.0


^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, other threads:[~2021-07-22 14:10 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-07-10 10:35 [dpdk-dev] [PATCH] net/mlx5: fix use after free in mlx5_dma_unmap wangyunjian
2021-07-22 14:10 ` Thomas Monjalon

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).