1. Patchew
  2. linux
  3. [PATCH v6 0/2] net/mlx5: Fix NULL dereference and memory leak in ttc_table creation
  4. View patch

[PATCH v6 2/2] net/mlx5: Move ttc allocation after switch case to prevent leaks

Henry Martin posted 2 patches 8 months, 1 week ago
There is a newer version of this series
[PATCH v6 2/2] net/mlx5: Move ttc allocation after switch case to prevent leaks
Posted by Henry Martin 8 months, 1 week ago 
Relocate the memory allocation for ttc table after the switch statement
that validates params->ns_type in both mlx5_create_inner_ttc_table() and
mlx5_create_ttc_table(). This ensures memory is only allocated after
confirming valid input, eliminating potential memory leaks when invalid
ns_type cases occur.

Signed-off-by: Henry Martin <bsdhenrymartin@gmail.com>
---
 .../net/ethernet/mellanox/mlx5/core/lib/fs_ttc.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.c
index 066121fed718..513dafd5ebf2 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.c
@@ -637,10 +637,6 @@ struct mlx5_ttc_table *mlx5_create_inner_ttc_table(struct mlx5_core_dev *dev,
 	bool use_l4_type;
 	int err;
 
-	ttc = kvzalloc(sizeof(*ttc), GFP_KERNEL);
-	if (!ttc)
-		return ERR_PTR(-ENOMEM);
-
 	switch (params->ns_type) {
 	case MLX5_FLOW_NAMESPACE_PORT_SEL:
 		use_l4_type = MLX5_CAP_GEN_2(dev, pcc_ifa2) &&
@@ -654,6 +650,10 @@ struct mlx5_ttc_table *mlx5_create_inner_ttc_table(struct mlx5_core_dev *dev,
 		return ERR_PTR(-EINVAL);
 	}
 
+	ttc = kvzalloc(sizeof(*ttc), GFP_KERNEL);
+	if (!ttc)
+		return ERR_PTR(-ENOMEM);
+
 	ns = mlx5_get_flow_namespace(dev, params->ns_type);
 	if (!ns) {
 		kvfree(ttc);
@@ -715,10 +715,6 @@ struct mlx5_ttc_table *mlx5_create_ttc_table(struct mlx5_core_dev *dev,
 	bool use_l4_type;
 	int err;
 
-	ttc = kvzalloc(sizeof(*ttc), GFP_KERNEL);
-	if (!ttc)
-		return ERR_PTR(-ENOMEM);
-
 	switch (params->ns_type) {
 	case MLX5_FLOW_NAMESPACE_PORT_SEL:
 		use_l4_type = MLX5_CAP_GEN_2(dev, pcc_ifa2) &&
@@ -732,6 +728,10 @@ struct mlx5_ttc_table *mlx5_create_ttc_table(struct mlx5_core_dev *dev,
 		return ERR_PTR(-EINVAL);
 	}
 
+	ttc = kvzalloc(sizeof(*ttc), GFP_KERNEL);
+	if (!ttc)
+		return ERR_PTR(-ENOMEM);
+
 	ns = mlx5_get_flow_namespace(dev, params->ns_type);
 	if (!ns) {
 		kvfree(ttc);
-- 
2.34.1
Re: [PATCH v6 2/2] net/mlx5: Move ttc allocation after switch case to prevent leaks
Posted by Mark Bloch 8 months, 1 week ago 

On 16/04/2025 12:22, Henry Martin wrote:
> Relocate the memory allocation for ttc table after the switch statement
> that validates params->ns_type in both mlx5_create_inner_ttc_table() and
> mlx5_create_ttc_table(). This ensures memory is only allocated after
> confirming valid input, eliminating potential memory leaks when invalid
> ns_type cases occur.
> 
> Signed-off-by: Henry Martin <bsdhenrymartin@gmail.com>
> ---
>  .../net/ethernet/mellanox/mlx5/core/lib/fs_ttc.c | 16 ++++++++--------
>  1 file changed, 8 insertions(+), 8 deletions(-)
> 
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.c
> index 066121fed718..513dafd5ebf2 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.c
> @@ -637,10 +637,6 @@ struct mlx5_ttc_table *mlx5_create_inner_ttc_table(struct mlx5_core_dev *dev,
>  	bool use_l4_type;
>  	int err;
>  
> -	ttc = kvzalloc(sizeof(*ttc), GFP_KERNEL);
> -	if (!ttc)
> -		return ERR_PTR(-ENOMEM);
> -
>  	switch (params->ns_type) {
>  	case MLX5_FLOW_NAMESPACE_PORT_SEL:
>  		use_l4_type = MLX5_CAP_GEN_2(dev, pcc_ifa2) &&
> @@ -654,6 +650,10 @@ struct mlx5_ttc_table *mlx5_create_inner_ttc_table(struct mlx5_core_dev *dev,
>  		return ERR_PTR(-EINVAL);
>  	}
>  
> +	ttc = kvzalloc(sizeof(*ttc), GFP_KERNEL);
> +	if (!ttc)
> +		return ERR_PTR(-ENOMEM);
> +
>  	ns = mlx5_get_flow_namespace(dev, params->ns_type);
>  	if (!ns) {
>  		kvfree(ttc);
> @@ -715,10 +715,6 @@ struct mlx5_ttc_table *mlx5_create_ttc_table(struct mlx5_core_dev *dev,
>  	bool use_l4_type;
>  	int err;
>  
> -	ttc = kvzalloc(sizeof(*ttc), GFP_KERNEL);
> -	if (!ttc)
> -		return ERR_PTR(-ENOMEM);
> -
>  	switch (params->ns_type) {
>  	case MLX5_FLOW_NAMESPACE_PORT_SEL:
>  		use_l4_type = MLX5_CAP_GEN_2(dev, pcc_ifa2) &&
> @@ -732,6 +728,10 @@ struct mlx5_ttc_table *mlx5_create_ttc_table(struct mlx5_core_dev *dev,
>  		return ERR_PTR(-EINVAL);
>  	}
>  
> +	ttc = kvzalloc(sizeof(*ttc), GFP_KERNEL);
> +	if (!ttc)
> +		return ERR_PTR(-ENOMEM);
> +
>  	ns = mlx5_get_flow_namespace(dev, params->ns_type);
>  	if (!ns) {
>  		kvfree(ttc);

Reviewed-by: Mark Bloch <mbloch@nvidia.com>

Mark
Re: [PATCH v6 2/2] net/mlx5: Move ttc allocation after switch case to prevent leaks
Posted by Jakub Kicinski 8 months ago 
On Wed, 16 Apr 2025 15:02:13 +0300 Mark Bloch wrote:
> On 16/04/2025 12:22, Henry Martin wrote:
> > Relocate the memory allocation for ttc table after the switch statement
> > that validates params->ns_type in both mlx5_create_inner_ttc_table() and
> > mlx5_create_ttc_table(). This ensures memory is only allocated after
> > confirming valid input, eliminating potential memory leaks when invalid
> > ns_type cases occur.
> 
> Reviewed-by: Mark Bloch <mbloch@nvidia.com>

A bit hard to see from the context but I'm guessing this fixes 
a memory leak? We need a Fixes tag..

reminder: please trim your replies
-- 
pw-bot: cr
Re: [PATCH v6 2/2] net/mlx5: Move ttc allocation after switch case to prevent leaks
Posted by henry martin 8 months ago 
> A bit hard to see from the context but I'm guessing this fixes
> a memory leak? We need a Fixes tag..

Thanks for the reminder. I've added the Fixes tag in v7.

Regards,
Henry
Re: [PATCH v6 2/2] net/mlx5: Move ttc allocation after switch case to prevent leaks
Posted by Michal Swiatkowski 8 months, 1 week ago 
On Wed, Apr 16, 2025 at 05:22:43PM +0800, Henry Martin wrote:
> Relocate the memory allocation for ttc table after the switch statement
> that validates params->ns_type in both mlx5_create_inner_ttc_table() and
> mlx5_create_ttc_table(). This ensures memory is only allocated after
> confirming valid input, eliminating potential memory leaks when invalid
> ns_type cases occur.
> 
> Signed-off-by: Henry Martin <bsdhenrymartin@gmail.com>
> ---
>  .../net/ethernet/mellanox/mlx5/core/lib/fs_ttc.c | 16 ++++++++--------
>  1 file changed, 8 insertions(+), 8 deletions(-)
> 
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.c
> index 066121fed718..513dafd5ebf2 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.c
> @@ -637,10 +637,6 @@ struct mlx5_ttc_table *mlx5_create_inner_ttc_table(struct mlx5_core_dev *dev,
>  	bool use_l4_type;
>  	int err;
>  
> -	ttc = kvzalloc(sizeof(*ttc), GFP_KERNEL);
> -	if (!ttc)
> -		return ERR_PTR(-ENOMEM);
> -
>  	switch (params->ns_type) {
>  	case MLX5_FLOW_NAMESPACE_PORT_SEL:
>  		use_l4_type = MLX5_CAP_GEN_2(dev, pcc_ifa2) &&
> @@ -654,6 +650,10 @@ struct mlx5_ttc_table *mlx5_create_inner_ttc_table(struct mlx5_core_dev *dev,
>  		return ERR_PTR(-EINVAL);
>  	}
>  
> +	ttc = kvzalloc(sizeof(*ttc), GFP_KERNEL);
> +	if (!ttc)
> +		return ERR_PTR(-ENOMEM);
> +
>  	ns = mlx5_get_flow_namespace(dev, params->ns_type);
>  	if (!ns) {
>  		kvfree(ttc);
> @@ -715,10 +715,6 @@ struct mlx5_ttc_table *mlx5_create_ttc_table(struct mlx5_core_dev *dev,
>  	bool use_l4_type;
>  	int err;
>  
> -	ttc = kvzalloc(sizeof(*ttc), GFP_KERNEL);
> -	if (!ttc)
> -		return ERR_PTR(-ENOMEM);
> -
>  	switch (params->ns_type) {
>  	case MLX5_FLOW_NAMESPACE_PORT_SEL:
>  		use_l4_type = MLX5_CAP_GEN_2(dev, pcc_ifa2) &&
> @@ -732,6 +728,10 @@ struct mlx5_ttc_table *mlx5_create_ttc_table(struct mlx5_core_dev *dev,
>  		return ERR_PTR(-EINVAL);
>  	}
>  
> +	ttc = kvzalloc(sizeof(*ttc), GFP_KERNEL);
> +	if (!ttc)
> +		return ERR_PTR(-ENOMEM);
> +
>  	ns = mlx5_get_flow_namespace(dev, params->ns_type);
>  	if (!ns) {
>  		kvfree(ttc);

Thanks for fixing
Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>

> -- 
> 2.34.1
>

Patchew 2.1-devel-b67e4c2

© 2016 - 2025 Red Hat, Inc.