Commit 70eeff66 authored by Roland Dreier's avatar Roland Dreier Committed by David S. Miller
Browse files

qed: Fix potential use-after-free in qed_spq_post()

We need to check if p_ent->comp_mode is QED_SPQ_MODE_EBLOCK before
calling qed_spq_add_entry().  The test is fine is the mode is EBLOCK,
but if it isn't then qed_spq_add_entry() might kfree(p_ent).
Signed-off-by: default avatarRoland Dreier <>
Signed-off-by: default avatarDavid S. Miller <>
parent 0d9c9f0f
......@@ -776,6 +776,7 @@ int qed_spq_post(struct qed_hwfn *p_hwfn,
int rc = 0;
struct qed_spq *p_spq = p_hwfn ? p_hwfn->p_spq : NULL;
bool b_ret_ent = true;
bool eblock;
if (!p_hwfn)
return -EINVAL;
......@@ -794,6 +795,11 @@ int qed_spq_post(struct qed_hwfn *p_hwfn,
if (rc)
goto spq_post_fail;
/* Check if entry is in block mode before qed_spq_add_entry,
* which might kfree p_ent.
eblock = (p_ent->comp_mode == QED_SPQ_MODE_EBLOCK);
/* Add the request to the pending queue */
rc = qed_spq_add_entry(p_hwfn, p_ent, p_ent->priority);
if (rc)
......@@ -811,7 +817,7 @@ int qed_spq_post(struct qed_hwfn *p_hwfn,
if (p_ent->comp_mode == QED_SPQ_MODE_EBLOCK) {
if (eblock) {
/* For entries in QED BLOCK mode, the completion code cannot
* perform the necessary cleanup - if it did, we couldn't
* access p_ent here to see whether it's successful or not.
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment