Commit e96e0ede authored by jbaron@akamai.com's avatar jbaron@akamai.com Committed by David S. Miller

bnx2x: free the mac filter group list before freeing the cmd

The group list must be freed prior to freeing the command otherwise
we have a use-after-free.
Signed-off-by: default avatarJason Baron <jbaron@akamai.com>
Cc: Yuval Mintz <Yuval.Mintz@qlogic.com>
Cc: Ariel Elior <Ariel.Elior@qlogic.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 44675a6d
...@@ -2714,8 +2714,8 @@ static int bnx2x_mcast_enqueue_cmd(struct bnx2x *bp, ...@@ -2714,8 +2714,8 @@ static int bnx2x_mcast_enqueue_cmd(struct bnx2x *bp,
elem_group = (struct bnx2x_mcast_elem_group *) elem_group = (struct bnx2x_mcast_elem_group *)
__get_free_page(GFP_ATOMIC | __GFP_ZERO); __get_free_page(GFP_ATOMIC | __GFP_ZERO);
if (!elem_group) { if (!elem_group) {
kfree(new_cmd);
bnx2x_free_groups(&new_cmd->group_head); bnx2x_free_groups(&new_cmd->group_head);
kfree(new_cmd);
return -ENOMEM; return -ENOMEM;
} }
total_elems -= MCAST_MAC_ELEMS_PER_PG; total_elems -= MCAST_MAC_ELEMS_PER_PG;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment