lkml.org 
[lkml]   [2019]   [Jun]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 18/32] net/mlx5: Avoid double free in fs init error unwinding path
    Date
    From: Parav Pandit <parav@mellanox.com>

    [ Upstream commit 9414277a5df3669c67e818708c0f881597e0118e ]

    In below code flow, for ingress acl table root ns memory leads
    to double free.

    mlx5_init_fs
    init_ingress_acls_root_ns()
    init_ingress_acl_root_ns
    kfree(steering->esw_ingress_root_ns);
    /* steering->esw_ingress_root_ns is not marked NULL */
    mlx5_cleanup_fs
    cleanup_ingress_acls_root_ns
    steering->esw_ingress_root_ns non NULL check passes.
    kfree(steering->esw_ingress_root_ns);
    /* double free */

    Similar issue exist for other tables.

    Hence zero out the pointers to not process the table again.

    Fixes: 9b93ab981e3bf ("net/mlx5: Separate ingress/egress namespaces for each vport")
    Fixes: 40c3eebb49e51 ("net/mlx5: Add support in RDMA RX steering")
    Signed-off-by: Parav Pandit <parav@mellanox.com>
    Reviewed-by: Mark Bloch <markb@mellanox.com>
    Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 4 ++++
    1 file changed, 4 insertions(+)

    --- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
    +++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
    @@ -2363,6 +2363,7 @@ static void cleanup_egress_acls_root_ns(
    cleanup_root_ns(steering->esw_egress_root_ns[i]);

    kfree(steering->esw_egress_root_ns);
    + steering->esw_egress_root_ns = NULL;
    }

    static void cleanup_ingress_acls_root_ns(struct mlx5_core_dev *dev)
    @@ -2377,6 +2378,7 @@ static void cleanup_ingress_acls_root_ns
    cleanup_root_ns(steering->esw_ingress_root_ns[i]);

    kfree(steering->esw_ingress_root_ns);
    + steering->esw_ingress_root_ns = NULL;
    }

    void mlx5_cleanup_fs(struct mlx5_core_dev *dev)
    @@ -2505,6 +2507,7 @@ cleanup_root_ns:
    for (i--; i >= 0; i--)
    cleanup_root_ns(steering->esw_egress_root_ns[i]);
    kfree(steering->esw_egress_root_ns);
    + steering->esw_egress_root_ns = NULL;
    return err;
    }

    @@ -2532,6 +2535,7 @@ cleanup_root_ns:
    for (i--; i >= 0; i--)
    cleanup_root_ns(steering->esw_ingress_root_ns[i]);
    kfree(steering->esw_ingress_root_ns);
    + steering->esw_ingress_root_ns = NULL;
    return err;
    }


    \
     
     \ /
      Last update: 2019-06-03 11:18    [W:3.368 / U:0.488 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site