mlxsw: core: Fix use-after-free calling devl_unlock() in mlxsw_core_bus_device_unregi...

Do devl_unlock() before freeing the devlink in
mlxsw_core_bus_device_unregister() function.

Reported-by: Ido Schimmel <idosch@nvidia.com>
Fixes: e8b3d39a154c ("mlxsw: convert driver to use unlocked devlink API during init/fini")
Signed-off-by: Jiri Pirko <jiri@nvidia.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://lore.kernel.org/r/20220721142424.3975704-1-jiri@resnulli.us
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/drivers/net/ethernet/mellanox/mlxsw/core.c b/drivers/net/ethernet/mellanox/mlxsw/core.c
index 61eb96b938892f23c6c44334c99ea5b3685ffc87..1b61bc8f59a2c40f253a4c7404e6c968d10cfc4d 100644 (file)
--- a/drivers/net/ethernet/mellanox/mlxsw/core.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/core.c
@@ -2296,8 +2296,8 @@ void mlxsw_core_bus_device_unregister(struct mlxsw_core *mlxsw_core,
                devl_resources_unregister(devlink);
        mlxsw_core->bus->fini(mlxsw_core->bus_priv);
        if (!reload) {
-               devlink_free(devlink);
                devl_unlock(devlink);
+               devlink_free(devlink);
        }
 
        return;
@@ -2305,8 +2305,8 @@ void mlxsw_core_bus_device_unregister(struct mlxsw_core *mlxsw_core,
 reload_fail_deinit:
        mlxsw_core_params_unregister(mlxsw_core);
        devl_resources_unregister(devlink);
-       devlink_free(devlink);
        devl_unlock(devlink);
+       devlink_free(devlink);
 }
 EXPORT_SYMBOL(mlxsw_core_bus_device_unregister);