Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.36 as permitted sender) client-ip=23.128.96.36;
Message-ID: <b7300fbb-41b5-4a30-b086-a8dde8ede207@nvidia.com>
Date:   Tue, 28 Nov 2023 14:53:33 +0200
User-Agent: Mozilla Thunderbird
Subject: Re: [PATCH] [v2] net/mlx5e: fix a potential double-free in
 fs_any_create_groups
Content-Language: en-US
To:     Dinghao Liu <dinghao.liu@zju.edu.cn>
Cc:     Saeed Mahameed <saeedm@nvidia.com>,
        Leon Romanovsky <leon@kernel.org>,
        "David S. Miller" <davem@davemloft.net>,
        Eric Dumazet <edumazet@google.com>,
        Jakub Kicinski <kuba@kernel.org>,
        Paolo Abeni <pabeni@redhat.com>,
        Rahul Rameshbabu <rrameshbabu@nvidia.com>,
        Zhengchao Shao <shaozhengchao@huawei.com>,
        Simon Horman <horms@kernel.org>, Aya Levin <ayal@nvidia.com>,
        netdev@vger.kernel.org, linux-rdma@vger.kernel.org,
        linux-kernel@vger.kernel.org
References: <20231128092904.2916-1-dinghao.liu@zju.edu.cn>
From:   Tariq Toukan <tariqt@nvidia.com>
In-Reply-To: <20231128092904.2916-1-dinghao.liu@zju.edu.cn>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?U012RHpKbktVb1M5U3hVKzdFQlEwNlgwQkpKQytxSDc2b0VBaERiYytrampM?=
 =?utf-8?B?MVd4a2ZsZXR1K3BGbHY4dktpeHhRN0J4bGlKVWRPcHpIYnZPMEdnc3NwMi9Y?=
 =?utf-8?B?dkFKVkRoc0pMWWFyQkpzajhGYzNVNVRET2FEdUN1TUtMeU85dlBjQWM0MU1s?=
 =?utf-8?B?TjF1MmVmczM5V1hQbTd5NWJsTjByWUd1NGVLZXVzQXhVL2RxTzBsUElEMnVr?=
 =?utf-8?B?YnY3UXNWdGN5bTZnZnBYenFnbkdtRXRnL0JaeVp6dTg5bjBOajc1OE1DcVl5?=
 =?utf-8?B?NTdFVU1adG4vdFRBaHErUVFPSU9lemtDWEtyYjNxSlFPb2pVWWdybWxQNVNK?=
 =?utf-8?B?eElncmovOHA0aU5ZVTBBTk4va0NLQjYzb3UxMDlkOGlXUUc5c0duL0Z0bVF6?=
 =?utf-8?B?TlJxcGN3MmYxVFkyd0d6bEFuZ2pMbHZGMGFlUjNmaGlTczVzd1BiNHo1WkFZ?=
 =?utf-8?B?SkZIc1RIQmtrZFVLcE5saEZvQU8wdXovYmNBRTVMU1ZNK2tXK0hEUHhGR1Jo?=
 =?utf-8?B?dUZVOHVhMzdRWkx2Rm9NOENMMy9KR04vQWVTZSt0bmtvbDRPYXdIb2RUVENJ?=
 =?utf-8?B?S3ZubXU1TGlueFdZdHhIdlE0WEV2K1c3T282NkFSd1EwOHFJRmJsNXJ0b3Jt?=
 =?utf-8?B?UEFYdXl5ekQ2ditvaHB5TjBYUkh5VVNaZUVqc1BNV2VJWXFPUDAvblo5UVAx?=
 =?utf-8?B?NFRmdHdiVzNJa3hMNEhSVUlYcnJxVTV1VW56SzhPc0dzZG9rZXVJTDVVRGhQ?=
 =?utf-8?B?SENzQXRtaWpCaklPaEJkU3ZXSlRpRTNwR1lpeDRMajZQeXMxd2U4TTI5ZUV1?=
 =?utf-8?B?WmlHMmovRjU3TEFJQlBVT05uRVdUMVBteStqeVpINTRkM2F6Vm5Vcm5lMFhw?=
 =?utf-8?B?MldHM3hFenlyOHB2dzEzUXFpTEsreVZabEl1Yk00NUwxK011aVYwTXZlTGpW?=
 =?utf-8?B?SVJwMVlMU0czdkMrdXRPVnRQVk5pT2ZUbXA4RnZSR3JKYWM1eFFkZllGY0s3?=
 =?utf-8?B?RDJlcE14V0VMTG5jMXRhZTBJNUJLdTBnVnBaYkZiVWpuNTUwdXY1V2d5bmlw?=
 =?utf-8?B?MHl6YWFya2NqcS9vZUNYc3VLbW5mUFdPRDNoRVZLU1RxNEtYVVlFS1VML2pG?=
 =?utf-8?B?OGxUNzVDSHhMVDNDZ1BQWlhucDlxWUVrYmlHdldLRVlkOWQwc05nV2d1Qkg1?=
 =?utf-8?B?VlRFbGdOdEJ0K25uWCtoY2RwSFZONUF3MWJMMkRsZVFmcUpqRmJKdkxnVEZh?=
 =?utf-8?B?MUdPUW5BdWE3d2o1TzhXVlBqK3YyTHRZeTQ5cFR1RGZhVWhaVk13RFRKMWVS?=
 =?utf-8?B?UWNEbUJJRkI4SWZnUVl2WHNSRlRkcTRvcS9Ka1p4RHh1TWV1cFF1MzhMWHJT?=
 =?utf-8?B?WlExd1hxQm9rU1ZkQjlOOG1NNmZ1SlN2VEhLM2Vxa3ZUSUFmTXdrSUNmWmdW?=
 =?utf-8?B?MEVmd2ZUN3ZYT21EalZoMEgrcGVoS0dnbVJ3S2RrYlRqS05IVXN0ZlUyTUtX?=
 =?utf-8?B?OFNWS05QNVlaVXd0Y3ArbG9pMXV3K2hHVStNTWNyaVI2UXh0azFmVzNhMzZD?=
 =?utf-8?B?aW0xVGxKamVERFN2K0FVMkZVandpZGY4U3ZXREFpUllnZW5NSFM3Z1JwdVJt?=
 =?utf-8?B?bXNvYlR2U05laXpFUXB1RnptQnFPbTU4MmJ1VEM3Vit3cEhsd21yZWY2YjNK?=
 =?utf-8?B?cndKL1VmWm9Rb3VoSFNDQ3RUSnJnN1R6NDlyMG9PTDE0azhDVUZ1ZmdHZ1dx?=
 =?utf-8?B?cFZFREZKVCs2NTZlSFFMNENXOXdxOEEvU01hUStKOWVxUXhKcU80dldWTGQz?=
 =?utf-8?B?QUdDZy9zMHNZc0liWEZVb24xaUFOdEdNK3NhM2RKYWIybkM2M3R3QXJIaEQ1?=
 =?utf-8?B?OFdlZ080OEtLVTg3MHdXVHJuczJpdG5FNmorTXpzTHR4V2NvR210QWRXZkNV?=
 =?utf-8?B?TTZpUThoVUlLVlhrRmpkNHJYTEhKL1JIQk1GK1dMZWd0YkNjQUJQc2ZUZUlY?=
 =?utf-8?B?UGUwc0JNMmNPMG0vWkozSXFSSVdEeVVWczluUEluS1VtdVZsL1p1UFl4MmNt?=
 =?utf-8?B?Y2wxWUw0QVgrTWZzL29vYUZtbG9BZUdVZktGMjNRbUgreGJ1RUZudHdmRkRw?=
 =?utf-8?Q?jN1uc8sDOI9vGBVP5RB562PCJ?=
X-OriginatorOrg: Nvidia.com
X-MS-Exchange-CrossTenant-Network-Message-Id: f94c2452-4df4-4302-fd03-08dbf0110bea
X-MS-Exchange-CrossTenant-AuthSource: IA1PR12MB6018.namprd12.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 28 Nov 2023 12:53:40.9276
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: wK6a3DNQqS60FZ4VazHK9eU6a6g+UPhuT/dFUwH+jhd3Kjd8IDPkQvAnlfLnZhuRlt4ZvrbOlrBzzLTc82kATg==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ2PR12MB8134
X-Spam-Status: No, score=-0.9 required=5.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED,
	DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,
	MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE
	autolearn=unavailable autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on pete.vger.email
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (pete.vger.email [0.0.0.0]); Tue, 28 Nov 2023 04:53:55 -0800 (PST)


On 28/11/2023 11:29, Dinghao Liu wrote:
> When kcalloc() for ft->g succeeds but kvzalloc() for in fails,
> fs_any_create_groups() will free ft->g. However, its caller
> fs_any_create_table() will free ft->g again through calling
> mlx5e_destroy_flow_table(), which will lead to a double-free.
> Fix this by setting ft->g to NULL in fs_any_create_groups().
> 
> Fixes: 0f575c20bf06 ("net/mlx5e: Introduce Flow Steering ANY API")
> Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
> ---
> 
> Changelog:
> 
> v2: Setting ft->g to NULL instead of removing the kfree().
> ---
>   drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c | 1 +
>   1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c b/drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c
> index be83ad9db82a..6207ffe74233 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c
> @@ -435,6 +435,7 @@ static int fs_any_create_groups(struct mlx5e_flow_table *ft)
>   	in = kvzalloc(inlen, GFP_KERNEL);
>   	if  (!in || !ft->g) {
>   		kfree(ft->g);
> +		ft->g = NULL;
>   		kvfree(in);
>   		return -ENOMEM;
>   	}

Reviewed-by: Tariq Toukan <tariqt@nvidia.com>