From: Saeed Mahameed <saeed@kernel•org>
To: "David S. Miller" <davem@davemloft•net>,
Jakub Kicinski <kuba@kernel•org>, Paolo Abeni <pabeni@redhat•com>,
Eric Dumazet <edumazet@google•com>
Cc: Saeed Mahameed <saeedm@nvidia•com>,
netdev@vger•kernel.org, Tariq Toukan <tariqt@nvidia•com>,
Zhengchao Shao <shaozhengchao@huawei•com>
Subject: [net 1/9] net/mlx5e: fix double free in mlx5e_destroy_flow_table
Date: Fri, 30 Jun 2023 11:15:36 -0700 [thread overview]
Message-ID: <20230630181544.82958-2-saeed@kernel.org> (raw)
In-Reply-To: <20230630181544.82958-1-saeed@kernel.org>
From: Zhengchao Shao <shaozhengchao@huawei•com>
In function accel_fs_tcp_create_groups(), when the ft->g memory is
successfully allocated but the 'in' memory fails to be allocated, the
memory pointed to by ft->g is released once. And in function
accel_fs_tcp_create_table, mlx5e_destroy_flow_table is called to release
the memory pointed to by ft->g again. This will cause double free problem.
Fixes: c062d52ac24c ("net/mlx5e: Receive flow steering framework for accelerated TCP flows")
Signed-off-by: Zhengchao Shao <shaozhengchao@huawei•com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia•com>
---
drivers/net/ethernet/mellanox/mlx5/core/en_accel/fs_tcp.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/fs_tcp.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/fs_tcp.c
index 88a5aed9d678..c7d191f66ad1 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/fs_tcp.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/fs_tcp.c
@@ -190,6 +190,7 @@ static int accel_fs_tcp_create_groups(struct mlx5e_flow_table *ft,
in = kvzalloc(inlen, GFP_KERNEL);
if (!in || !ft->g) {
kfree(ft->g);
+ ft->g = NULL;
kvfree(in);
return -ENOMEM;
}
--
2.41.0
next prev parent reply other threads:[~2023-06-30 18:15 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-06-30 18:15 [pull request][net 0/9] mlx5 fixes 2023-06-30 Saeed Mahameed
2023-06-30 18:15 ` Saeed Mahameed [this message]
2023-06-30 18:15 ` [net 2/9] net/mlx5e: fix memory leak in mlx5e_fs_tt_redirect_any_create Saeed Mahameed
2023-06-30 18:15 ` [net 3/9] net/mlx5e: fix memory leak in mlx5e_ptp_open Saeed Mahameed
2023-06-30 18:15 ` [net 4/9] net/mlx5e: RX, Fix flush and close release flow of regular rq for legacy rq Saeed Mahameed
2023-06-30 18:15 ` [net 5/9] net/mlx5: Register a unique thermal zone per device Saeed Mahameed
2023-06-30 20:10 ` Simon Horman
2023-06-30 18:15 ` [net 6/9] net/mlx5e: Check for NOT_READY flag state after locking Saeed Mahameed
2023-06-30 18:15 ` [net 7/9] net/mlx5e: TC, CT: Offload ct clear only once Saeed Mahameed
2023-06-30 18:15 ` [net 8/9] net/mlx5: Query hca_cap_2 only when supported Saeed Mahameed
2023-06-30 18:15 ` [net 9/9] net/mlx5e: RX, Fix page_pool page fragment tracking for XDP Saeed Mahameed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230630181544.82958-2-saeed@kernel.org \
--to=saeed@kernel$(echo .)org \
--cc=davem@davemloft$(echo .)net \
--cc=edumazet@google$(echo .)com \
--cc=kuba@kernel$(echo .)org \
--cc=netdev@vger$(echo .)kernel.org \
--cc=pabeni@redhat$(echo .)com \
--cc=saeedm@nvidia$(echo .)com \
--cc=shaozhengchao@huawei$(echo .)com \
--cc=tariqt@nvidia$(echo .)com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox