freebsd-dev/sys/dev/mlx4/mlx4_core
Hans Petter Selasky dd2a8c8f72 mlx4core: Use-after-free causes a resource leak in flow-steering detach
mlx4_QP_FLOW_STEERING_DETACH_wrapper first removes the steering
rule (which results in freeing the rule structure), and then
references a field in this struct (the qp number) when releasing the
busy-status on the rule's qp.

Since this memory was freed, it could reallocated and changed.
Therefore, the qp number in the struct may be incorrect,
so that we are releasing the incorrect qp. This leaves the rule's qp
in the busy state (and could possibly release an incorrect qp as well).

Fix this by saving the qp number in a local variable, for use after
removing the steering rule.

Linux commit:
3b01fe7f91c8e4f9afc4fae3c5af72c14958d2d8

PR:	     	264469
MFC after:	1 week
Sponsored by:	NVIDIA Networking
2022-06-07 16:28:32 +02:00
..
fw_qos.h mlx4en(4): Fix two in source code comments 2022-04-02 13:33:57 +02:00
fw.h
icm.h
mlx4_alloc.c
mlx4_catas.c
mlx4_cmd.c mlx4en(4): Fix two in source code comments 2022-04-02 13:33:57 +02:00
mlx4_cq.c
mlx4_eq.c mlx4: Remove a variable only used in commented-out code. 2022-04-08 17:25:13 -07:00
mlx4_fw_qos.c
mlx4_fw.c mlx4: Fix a memory leak bug. 2022-05-19 10:13:06 +02:00
mlx4_icm.c
mlx4_intf.c
mlx4_main.c
mlx4_mcg.c
mlx4_mr.c
mlx4_pd.c
mlx4_port.c
mlx4_profile.c
mlx4_qp.c
mlx4_reset.c
mlx4_resource_tracker.c mlx4core: Use-after-free causes a resource leak in flow-steering detach 2022-06-07 16:28:32 +02:00
mlx4_sense.c
mlx4_srq.c
mlx4.h mlx5/mlx4: Bump driver version to 3.7.1 2022-03-08 13:12:03 +01:00