net/mlx5e: fix a double-free in arfs_create_groups
[ Upstream commit 3c6d5189246f590e4e1f167991558bdb72a4738b ]
When `in` allocated by kvzalloc fails, arfs_create_groups will free
ft->g and return an error. However, arfs_create_table, the only caller of
arfs_create_groups, will hold this error and call to
mlx5e_destroy_flow_table, in which the ft->g will be freed again.
Fixes: 1cabe6b096
("net/mlx5e: Create aRFS flow tables")
Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
890881d10f
commit
42876db001
|
@ -255,11 +255,13 @@ static int arfs_create_groups(struct mlx5e_flow_table *ft,
|
|||
|
||||
ft->g = kcalloc(MLX5E_ARFS_NUM_GROUPS,
|
||||
sizeof(*ft->g), GFP_KERNEL);
|
||||
in = kvzalloc(inlen, GFP_KERNEL);
|
||||
if (!in || !ft->g) {
|
||||
kfree(ft->g);
|
||||
kvfree(in);
|
||||
if (!ft->g)
|
||||
return -ENOMEM;
|
||||
|
||||
in = kvzalloc(inlen, GFP_KERNEL);
|
||||
if (!in) {
|
||||
err = -ENOMEM;
|
||||
goto err_free_g;
|
||||
}
|
||||
|
||||
mc = MLX5_ADDR_OF(create_flow_group_in, in, match_criteria);
|
||||
|
@ -279,7 +281,7 @@ static int arfs_create_groups(struct mlx5e_flow_table *ft,
|
|||
break;
|
||||
default:
|
||||
err = -EINVAL;
|
||||
goto out;
|
||||
goto err_free_in;
|
||||
}
|
||||
|
||||
switch (type) {
|
||||
|
@ -301,7 +303,7 @@ static int arfs_create_groups(struct mlx5e_flow_table *ft,
|
|||
break;
|
||||
default:
|
||||
err = -EINVAL;
|
||||
goto out;
|
||||
goto err_free_in;
|
||||
}
|
||||
|
||||
MLX5_SET_CFG(in, match_criteria_enable, MLX5_MATCH_OUTER_HEADERS);
|
||||
|
@ -310,7 +312,7 @@ static int arfs_create_groups(struct mlx5e_flow_table *ft,
|
|||
MLX5_SET_CFG(in, end_flow_index, ix - 1);
|
||||
ft->g[ft->num_groups] = mlx5_create_flow_group(ft->t, in);
|
||||
if (IS_ERR(ft->g[ft->num_groups]))
|
||||
goto err;
|
||||
goto err_clean_group;
|
||||
ft->num_groups++;
|
||||
|
||||
memset(in, 0, inlen);
|
||||
|
@ -319,18 +321,20 @@ static int arfs_create_groups(struct mlx5e_flow_table *ft,
|
|||
MLX5_SET_CFG(in, end_flow_index, ix - 1);
|
||||
ft->g[ft->num_groups] = mlx5_create_flow_group(ft->t, in);
|
||||
if (IS_ERR(ft->g[ft->num_groups]))
|
||||
goto err;
|
||||
goto err_clean_group;
|
||||
ft->num_groups++;
|
||||
|
||||
kvfree(in);
|
||||
return 0;
|
||||
|
||||
err:
|
||||
err_clean_group:
|
||||
err = PTR_ERR(ft->g[ft->num_groups]);
|
||||
ft->g[ft->num_groups] = NULL;
|
||||
out:
|
||||
err_free_in:
|
||||
kvfree(in);
|
||||
|
||||
err_free_g:
|
||||
kfree(ft->g);
|
||||
ft->g = NULL;
|
||||
return err;
|
||||
}
|
||||
|
||||
|
|
Loading…
Reference in New Issue