From nobody Fri Dec 26 07:19:21 2025 Received: from zg8tmty3ljk5ljewns4xndka.icoremail.net (zg8tmty3ljk5ljewns4xndka.icoremail.net [167.99.105.149]) by smtp.subspace.kernel.org (Postfix) with ESMTP id BB44D524D3; Mon, 8 Jan 2024 15:28:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=zju.edu.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=zju.edu.cn Received: from luzhipeng.223.5.5.5 (unknown [183.159.171.224]) by mail-app2 (Coremail) with SMTP id by_KCgBn+fBKGZxleMgHAA--.4251S2; Mon, 08 Jan 2024 23:48:27 +0800 (CST) From: Zhipeng Lu To: alexious@zju.edu.cn Cc: Simon Horman , Saeed Mahameed , Leon Romanovsky , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Maor Gottlieb , netdev@vger.kernel.org, linux-rdma@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] [v2] net/mlx5e: fix a double-free in arfs_create_groups Date: Mon, 8 Jan 2024 23:26:04 +0800 Message-Id: <20240108152605.3712050-1-alexious@zju.edu.cn> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: by_KCgBn+fBKGZxleMgHAA--.4251S2 X-Coremail-Antispam: 1UD129KBjvJXoWxZrWUXrWrXw4kWF48KrWDCFg_yoW5Ar48pF 45J34DKFs5Za48XanrA3yvqw1rCa18tayUu3WIv34SqwnFyr4UCFyrK3y3AFyxCFW3ArnF y3Z8Zw1UAFZxArUanT9S1TB71UUUUUUqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUvj14x267AKxVW8JVW5JwAFc2x0x2IEx4CE42xK8VAvwI8IcIk0 rVWrJVCq3wAFIxvE14AKwVWUJVWUGwA2ocxC64kIII0Yj41l84x0c7CEw4AK67xGY2AK02 1l84ACjcxK6xIIjxv20xvE14v26w1j6s0DM28EF7xvwVC0I7IYx2IY6xkF7I0E14v26r4U JVWxJr1l84ACjcxK6I8E87Iv67AKxVW0oVCq3wA2z4x0Y4vEx4A2jsIEc7CjxVAFwI0_Gc CE3s1le2I262IYc4CY6c8Ij28IcVAaY2xG8wAqx4xG64xvF2IEw4CE5I8CrVC2j2WlYx0E 2Ix0cI8IcVAFwI0_Jr0_Jr4lYx0Ex4A2jsIE14v26r1j6r4UMcvjeVCFs4IE7xkEbVWUJV W8JwACjcxG0xvY0x0EwIxGrwACjI8F5VA0II8E6IAqYI8I648v4I1lFIxGxcIEc7CjxVA2 Y2ka0xkIwI1l42xK82IYc2Ij64vIr41l4I8I3I0E4IkC6x0Yz7v_Jr0_Gr1lx2IqxVAqx4 xG67AKxVWUJVWUGwC20s026x8GjcxK67AKxVWUGVWUWwC2zVAF1VAY17CE14v26r1q6r43 MIIYrxkI7VAKI48JMIIF0xvE2Ix0cI8IcVAFwI0_Jr0_JF4lIxAIcVC0I7IYx2IY6xkF7I 0E14v26r4j6F4UMIIF0xvE42xK8VAvwI8IcIk0rVWUJVWUCwCI42IY6I8E87Iv67AKxVWU JVW8JwCI42IY6I8E87Iv6xkF7I0E14v26r4j6r4UJbIYCTnIWIevJa73UjIFyTuYvjfUoO J5UUUUU X-CM-SenderInfo: qrsrjiarszq6lmxovvfxof0/ Content-Type: text/plain; charset="utf-8" When `in` allocated by kvzalloc fails, arfs_create_groups will free ft->g and return an error. However, arfs_create_table, the only caller of arfs_create_groups, will hold this error and call to mlx5e_destroy_flow_table, in which the ft->g will be freed again. Fixes: 1cabe6b0965e ("net/mlx5e: Create aRFS flow tables") Signed-off-by: Zhipeng Lu Reviewed-by: Simon Horman --- Changelog: v2: free ft->g just in arfs_create_groups with a unwind ladde. --- .../net/ethernet/mellanox/mlx5/core/en_arfs.c | 17 +++++++++-------- drivers/net/ethernet/mellanox/mlx5/core/en_fs.c | 1 - 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c b/drivers/ne= t/ethernet/mellanox/mlx5/core/en_arfs.c index bb7f86c993e5..c96f4c571b63 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c @@ -252,13 +252,14 @@ static int arfs_create_groups(struct mlx5e_flow_table= *ft, int err; u8 *mc; =20 + ft->num_groups =3D 0; + ft->g =3D kcalloc(MLX5E_ARFS_NUM_GROUPS, sizeof(*ft->g), GFP_KERNEL); in =3D kvzalloc(inlen, GFP_KERNEL); if (!in || !ft->g) { - kfree(ft->g); - kvfree(in); - return -ENOMEM; + err =3D -ENOMEM; + goto free_ft; } =20 mc =3D MLX5_ADDR_OF(create_flow_group_in, in, match_criteria); @@ -278,7 +279,7 @@ static int arfs_create_groups(struct mlx5e_flow_table *= ft, break; default: err =3D -EINVAL; - goto out; + goto free_ft; } =20 switch (type) { @@ -300,7 +301,7 @@ static int arfs_create_groups(struct mlx5e_flow_table *= ft, break; default: err =3D -EINVAL; - goto out; + goto free_ft; } =20 MLX5_SET_CFG(in, match_criteria_enable, MLX5_MATCH_OUTER_HEADERS); @@ -327,7 +328,9 @@ static int arfs_create_groups(struct mlx5e_flow_table *= ft, err: err =3D PTR_ERR(ft->g[ft->num_groups]); ft->g[ft->num_groups] =3D NULL; -out: +free_ft: + kfree(ft->g); + ft->g =3D NULL; kvfree(in); =20 return err; @@ -343,8 +346,6 @@ static int arfs_create_table(struct mlx5e_flow_steering= *fs, struct mlx5_flow_table_attr ft_attr =3D {}; int err; =20 - ft->num_groups =3D 0; - ft_attr.max_fte =3D MLX5E_ARFS_TABLE_SIZE; ft_attr.level =3D MLX5E_ARFS_FT_LEVEL; ft_attr.prio =3D MLX5E_NIC_PRIO; diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c b/drivers/net/= ethernet/mellanox/mlx5/core/en_fs.c index 777d311d44ef..7b6aa0c8b58d 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c @@ -883,7 +883,6 @@ void mlx5e_fs_init_l2_addr(struct mlx5e_flow_steering *= fs, struct net_device *ne void mlx5e_destroy_flow_table(struct mlx5e_flow_table *ft) { mlx5e_destroy_groups(ft); - kfree(ft->g); mlx5_destroy_flow_table(ft->t); ft->t =3D NULL; } --=20 2.34.1