Messages in this thread | ![/](/images/icornerl.gif) | | Date | Thu, 21 Dec 2023 01:30:59 +0800 (GMT+08:00) | From | alexious@zju ... | Subject | Re: Re: [PATCH] sfc: fix a double-free bug in efx_probe_filters |
| |
> On Thu, Dec 14, 2023 at 11:22:46PM +0800, Zhipeng Lu wrote: > > In efx_probe_filters, the channel->rps_flow_id is freed in a > > efx_for_each_channel marco when success equals to 0. > > However, after the following call chain: > > > > efx_probe_filters > > |-> ef100_net_open > > |-> ef100_net_stop > > |-> efx_remove_filters > > I think the call chain may be a bit more like: > > ef100_net_open > |-> efx_probe_filters > |-> ef100_net_stop > |-> efx_remove_filters > > > > > The channel->rps_flow_id is freed again in the efx_for_each_channel of > > efx_remove_filters, triggering a double-free bug. > > > > Fixes: a9dc3d5612ce ("sfc_ef100: RX filter table management and related gubbins") > > Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn> > > The above nit not withstanding, I agree with your reasoning. > And that the problem was introduced in the cited commit. > > Reviewed-by: Simon Horman <horms@kernel.org>
Sorry for the call-chain's problem, I was not familiar with it at that time. Thanks for Simon's correction. Appreciate! I'll soon send a v2 patch with the corrected call-chain and RB tags.
| ![\](/images/icornerr.gif) |