netdev - Re: [net V2 1/9] net/mlx5e: fix double free in mlx5e_destroy_flow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZKXDJhDNMjEPUzC0@localhost.localdomain>
Date: Wed, 5 Jul 2023 21:23:18 +0200
From: Michal Kubiak <michal.kubiak@...el.com>
To: Saeed Mahameed <saeed@...nel.org>
CC: "David S. Miller" <davem@...emloft.net>, Jakub Kicinski <kuba@...nel.org>,
	Paolo Abeni <pabeni@...hat.com>, Eric Dumazet <edumazet@...gle.com>, "Saeed
 Mahameed" <saeedm@...dia.com>, <netdev@...r.kernel.org>, Tariq Toukan
	<tariqt@...dia.com>, Zhengchao Shao <shaozhengchao@...wei.com>
Subject: Re: [net V2 1/9] net/mlx5e: fix double free in
 mlx5e_destroy_flow_table

On Wed, Jul 05, 2023 at 10:57:49AM -0700, Saeed Mahameed wrote:
> From: Zhengchao Shao <shaozhengchao@...wei.com>
> 
> In function accel_fs_tcp_create_groups(), when the ft->g memory is
> successfully allocated but the 'in' memory fails to be allocated, the
> memory pointed to by ft->g is released once. And in function
> accel_fs_tcp_create_table, mlx5e_destroy_flow_table is called to release
> the memory pointed to by ft->g again. This will cause double free problem.
> 
> Fixes: c062d52ac24c ("net/mlx5e: Receive flow steering framework for accelerated TCP flows")
> Signed-off-by: Zhengchao Shao <shaozhengchao@...wei.com>
> Signed-off-by: Saeed Mahameed <saeedm@...dia.com>

LGTM

Thanks,
Reviewed-by: Michal Kubiak <michal.kubiak@...el.com>

> ---
>  drivers/net/ethernet/mellanox/mlx5/core/en_accel/fs_tcp.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/fs_tcp.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/fs_tcp.c
> index 88a5aed9d678..c7d191f66ad1 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/fs_tcp.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/fs_tcp.c
> @@ -190,6 +190,7 @@ static int accel_fs_tcp_create_groups(struct mlx5e_flow_table *ft,
>  	in = kvzalloc(inlen, GFP_KERNEL);
>  	if  (!in || !ft->g) {
>  		kfree(ft->g);
> +		ft->g = NULL;
>  		kvfree(in);
>  		return -ENOMEM;
>  	}
> -- 
> 2.41.0
> 
>