From 2e18f10dfd55ec5dee6ce356393eb3e7f91be215 Mon Sep 17 00:00:00 2001 From: "jbaron@akamai.com" Date: Mon, 26 Sep 2016 11:00:44 -0400 Subject: [PATCH] bnx2x: free the mac filter group list before freeing the cmd Orabug: 25477835 The group list must be freed prior to freeing the command otherwise we have a use-after-free. Signed-off-by: Jason Baron Cc: Yuval Mintz Cc: Ariel Elior Signed-off-by: David S. Miller (cherry picked from commit e96e0eded1335b9cfac71fcdd989d682eb3f8412) Signed-off-by: Brian Maly --- drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c index 45e4a9a8f007..90e6ccbeeb46 100644 --- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c +++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c @@ -2467,8 +2467,8 @@ static int bnx2x_mcast_enqueue_cmd(struct bnx2x *bp, elem_group = (struct bnx2x_mcast_elem_group *) __get_free_page(GFP_ATOMIC | __GFP_ZERO); if (!elem_group) { - kfree(new_cmd); bnx2x_free_groups(&new_cmd->group_head); + kfree(new_cmd); return -ENOMEM; } total_elems -= MCAST_MAC_ELEMS_PER_PG; -- 2.50.1