aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
author[email protected] <[email protected]>2016-09-26 11:00:44 -0400
committerDavid S. Miller <[email protected]>2016-09-27 09:55:18 -0400
commite96e0eded1335b9cfac71fcdd989d682eb3f8412 (patch)
treec220652dd78b24042eb510f6736d6ca05e4ffdec
parent44675a6df839259102178c1e0c3c082821fcb8b7 (diff)
bnx2x: free the mac filter group list before freeing the cmd
The group list must be freed prior to freeing the command otherwise we have a use-after-free. Signed-off-by: Jason Baron <[email protected]> Cc: Yuval Mintz <[email protected]> Cc: Ariel Elior <[email protected]> Signed-off-by: David S. Miller <[email protected]>
-rw-r--r--drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
index 4947a9cbf0c1..cea6bdcde33f 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
@@ -2714,8 +2714,8 @@ static int bnx2x_mcast_enqueue_cmd(struct bnx2x *bp,
elem_group = (struct bnx2x_mcast_elem_group *)
__get_free_page(GFP_ATOMIC | __GFP_ZERO);
if (!elem_group) {
- kfree(new_cmd);
bnx2x_free_groups(&new_cmd->group_head);
+ kfree(new_cmd);
return -ENOMEM;
}
total_elems -= MCAST_MAC_ELEMS_PER_PG;