Ksawlii/kernel_samsung_a53x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

net/mlx5e: fix a double-free in arfs_create_groups

Browse source 
[ Upstream commit 3c6d5189246f590e4e1f167991558bdb72a4738b ]

When `in` allocated by kvzalloc fails, arfs_create_groups will free
ft->g and return an error. However, arfs_create_table, the only caller of
arfs_create_groups, will hold this error and call to
mlx5e_destroy_flow_table, in which the ft->g will be freed again.

Fixes: 1cabe6b0965e ("net/mlx5e: Create aRFS flow tables")
Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Zhipeng Lu 2024-01-17 15:17:36 +08:00 • committed by Ksawlii
parent 937fd965d2
commit cfa8d17771
1 changed files with 15 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

26
drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c
View file

@ -208,11 +208,13 @@ static int arfs_create_groups(struct mlx5e_flow_table *ft,
ft->g = kcalloc(MLX5E_ARFS_NUM_GROUPS, ft->g = kcalloc(MLX5E_ARFS_NUM_GROUPS,
sizeof(*ft->g), GFP_KERNEL); sizeof(*ft->g), GFP_KERNEL);
in = kvzalloc(inlen, GFP_KERNEL); if (!ft->g)
if (!in || !ft->g) {
kfree(ft->g);
kvfree(in);
return -ENOMEM; return -ENOMEM;
in = kvzalloc(inlen, GFP_KERNEL);
if (!in) {
err = -ENOMEM;
goto err_free_g;
} }
mc = MLX5_ADDR_OF(create_flow_group_in, in, match_criteria); mc = MLX5_ADDR_OF(create_flow_group_in, in, match_criteria);
@ -232,7 +234,7 @@ static int arfs_create_groups(struct mlx5e_flow_table *ft,
break; break;
default: default:
err = -EINVAL; err = -EINVAL;
goto out; goto err_free_in;
} }
switch (type) { switch (type) {
@ -254,7 +256,7 @@ static int arfs_create_groups(struct mlx5e_flow_table *ft,
break; break;
default: default:
err = -EINVAL; err = -EINVAL;
goto out; goto err_free_in;
} }
MLX5_SET_CFG(in, match_criteria_enable, MLX5_MATCH_OUTER_HEADERS); MLX5_SET_CFG(in, match_criteria_enable, MLX5_MATCH_OUTER_HEADERS);
@ -263,7 +265,7 @@ static int arfs_create_groups(struct mlx5e_flow_table *ft,
MLX5_SET_CFG(in, end_flow_index, ix - 1); MLX5_SET_CFG(in, end_flow_index, ix - 1);
ft->g[ft->num_groups] = mlx5_create_flow_group(ft->t, in); ft->g[ft->num_groups] = mlx5_create_flow_group(ft->t, in);
if (IS_ERR(ft->g[ft->num_groups])) if (IS_ERR(ft->g[ft->num_groups]))
goto err; goto err_clean_group;
ft->num_groups++; ft->num_groups++;
memset(in, 0, inlen); memset(in, 0, inlen);
@ -272,18 +274,20 @@ static int arfs_create_groups(struct mlx5e_flow_table *ft,
MLX5_SET_CFG(in, end_flow_index, ix - 1); MLX5_SET_CFG(in, end_flow_index, ix - 1);
ft->g[ft->num_groups] = mlx5_create_flow_group(ft->t, in); ft->g[ft->num_groups] = mlx5_create_flow_group(ft->t, in);
if (IS_ERR(ft->g[ft->num_groups])) if (IS_ERR(ft->g[ft->num_groups]))
goto err; goto err_clean_group;
ft->num_groups++; ft->num_groups++;
kvfree(in); kvfree(in);
return 0; return 0;
err: err_clean_group:
err = PTR_ERR(ft->g[ft->num_groups]); err = PTR_ERR(ft->g[ft->num_groups]);
ft->g[ft->num_groups] = NULL; ft->g[ft->num_groups] = NULL;
out: err_free_in:
kvfree(in); kvfree(in);
err_free_g:
kfree(ft->g);
ft->g = NULL;
return err; return err;
} }