linux-kernel - Re: [PATCH] [v3] net/mlx5e: fix a double-free in arfs_create

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20240113153313.GH392144@kernel.org>
Date: Sat, 13 Jan 2024 15:33:13 +0000
From: Simon Horman <horms@...nel.org>
To: Zhipeng Lu <alexious@....edu.cn>
Cc: Saeed Mahameed <saeedm@...dia.com>, Leon Romanovsky <leon@...nel.org>,
	"David S. Miller" <davem@...emloft.net>,
	Eric Dumazet <edumazet@...gle.com>,
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
	Maor Gottlieb <maorg@...lanox.com>, netdev@...r.kernel.org,
	linux-rdma@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] [v3] net/mlx5e: fix a double-free in arfs_create_groups

On Fri, Jan 12, 2024 at 03:29:16PM +0800, Zhipeng Lu wrote:
> When `in` allocated by kvzalloc fails, arfs_create_groups will free
> ft->g and return an error. However, arfs_create_table, the only caller of
> arfs_create_groups, will hold this error and call to
> mlx5e_destroy_flow_table, in which the ft->g will be freed again.
> 
> Fixes: 1cabe6b0965e ("net/mlx5e: Create aRFS flow tables")
> Signed-off-by: Zhipeng Lu <alexious@....edu.cn>

Thanks, I think this is getting close.

Can you please prepare a v4 with the nits below fixed?
And please target at the 'net' tree, by making sure it
is based on the main branch of that tree, and marking
the subject as follows:

	Subject: [PATCH net v3] ...

> ---
> Changelog:
> 
> v2: free ft->g just in arfs_create_groups with a unwind ladder.
> v3: split the allocation of ft->g and in. Rename the error label.
>     remove some refector change in v2.
> ---
>  .../net/ethernet/mellanox/mlx5/core/en_arfs.c | 26 +++++++++++--------
>  1 file changed, 15 insertions(+), 11 deletions(-)
> 
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c
> index bb7f86c993e5..0424ae068a60 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c
> @@ -254,11 +254,13 @@ static int arfs_create_groups(struct mlx5e_flow_table *ft,
>  
>  	ft->g = kcalloc(MLX5E_ARFS_NUM_GROUPS,
>  			sizeof(*ft->g), GFP_KERNEL);
> -	in = kvzalloc(inlen, GFP_KERNEL);
> -	if  (!in || !ft->g) {
> -		kfree(ft->g);
> -		kvfree(in);
> +	if(!ft->g)

nit: (one) space after if, please

>  		return -ENOMEM;
> +
> +	in = kvzalloc(inlen, GFP_KERNEL);
> +	if  (!in) {

nit: one space is enough after if

> +		err = -ENOMEM;
> +		goto err_free_g;
>  	}
>  
>  	mc = MLX5_ADDR_OF(create_flow_group_in, in, match_criteria);

..