Commit 9414277a authored by Parav Pandit's avatar Parav Pandit Committed by Saeed Mahameed

net/mlx5: Avoid double free in fs init error unwinding path

In below code flow, for ingress acl table root ns memory leads
to double free.

mlx5_init_fs
  init_ingress_acls_root_ns()
    init_ingress_acl_root_ns
       kfree(steering->esw_ingress_root_ns);
       /* steering->esw_ingress_root_ns is not marked NULL */
  mlx5_cleanup_fs
    cleanup_ingress_acls_root_ns
       steering->esw_ingress_root_ns non NULL check passes.
       kfree(steering->esw_ingress_root_ns);
       /* double free */

Similar issue exist for other tables.

Hence zero out the pointers to not process the table again.

Fixes: 9b93ab98 ("net/mlx5: Separate ingress/egress namespaces for each vport")
Fixes: 40c3eebb49e51 ("net/mlx5: Add support in RDMA RX steering")
Signed-off-by: default avatarParav Pandit <parav@mellanox.com>
Reviewed-by: default avatarMark Bloch <markb@mellanox.com>
Signed-off-by: default avatarSaeed Mahameed <saeedm@mellanox.com>
parent 905f6bd3
...@@ -2427,6 +2427,7 @@ static void cleanup_egress_acls_root_ns(struct mlx5_core_dev *dev) ...@@ -2427,6 +2427,7 @@ static void cleanup_egress_acls_root_ns(struct mlx5_core_dev *dev)
cleanup_root_ns(steering->esw_egress_root_ns[i]); cleanup_root_ns(steering->esw_egress_root_ns[i]);
kfree(steering->esw_egress_root_ns); kfree(steering->esw_egress_root_ns);
steering->esw_egress_root_ns = NULL;
} }
static void cleanup_ingress_acls_root_ns(struct mlx5_core_dev *dev) static void cleanup_ingress_acls_root_ns(struct mlx5_core_dev *dev)
...@@ -2441,6 +2442,7 @@ static void cleanup_ingress_acls_root_ns(struct mlx5_core_dev *dev) ...@@ -2441,6 +2442,7 @@ static void cleanup_ingress_acls_root_ns(struct mlx5_core_dev *dev)
cleanup_root_ns(steering->esw_ingress_root_ns[i]); cleanup_root_ns(steering->esw_ingress_root_ns[i]);
kfree(steering->esw_ingress_root_ns); kfree(steering->esw_ingress_root_ns);
steering->esw_ingress_root_ns = NULL;
} }
void mlx5_cleanup_fs(struct mlx5_core_dev *dev) void mlx5_cleanup_fs(struct mlx5_core_dev *dev)
...@@ -2625,6 +2627,7 @@ static int init_egress_acls_root_ns(struct mlx5_core_dev *dev) ...@@ -2625,6 +2627,7 @@ static int init_egress_acls_root_ns(struct mlx5_core_dev *dev)
for (i--; i >= 0; i--) for (i--; i >= 0; i--)
cleanup_root_ns(steering->esw_egress_root_ns[i]); cleanup_root_ns(steering->esw_egress_root_ns[i]);
kfree(steering->esw_egress_root_ns); kfree(steering->esw_egress_root_ns);
steering->esw_egress_root_ns = NULL;
return err; return err;
} }
...@@ -2652,6 +2655,7 @@ static int init_ingress_acls_root_ns(struct mlx5_core_dev *dev) ...@@ -2652,6 +2655,7 @@ static int init_ingress_acls_root_ns(struct mlx5_core_dev *dev)
for (i--; i >= 0; i--) for (i--; i >= 0; i--)
cleanup_root_ns(steering->esw_ingress_root_ns[i]); cleanup_root_ns(steering->esw_ingress_root_ns[i]);
kfree(steering->esw_ingress_root_ns); kfree(steering->esw_ingress_root_ns);
steering->esw_ingress_root_ns = NULL;
return err; return err;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment