Re: [PATCH 6.1.y] net/mlx5e: TC, Fix internal port memory leak

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] mlx5e: double free of int_port in flow post actions backport
--

commit 31e3e836a049949a2f6ef2d83fb49017f4be37e3
Author: Jianbo Liu <jianbol@nvidia.com>

net/mlx5e: TC, Fix internal port memory leak

This commit attempts to fix a memory leak of the internal port object when
flow rules forward packets from an internal port over a tunnel. It moves the
cleanup into free_flow_post_acts() to release references on cloned
post-action attributes.

> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
> index 05888942ef276..d2f226a09a0c7 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
[ ... ]
> @@ -3713,6 +3714,16 @@ free_flow_post_acts(struct mlx5e_tc_flow *flow)
>  				mlx5_modify_header_dealloc(flow->priv->mdev, attr->modify_hdr);
>  		}
>  
> +		if (mlx5e_is_eswitch_flow(flow)) {
> +			esw_attr = attr->esw_attr;
> +			if (esw_attr->int_port)
> +				mlx5e_tc_int_port_put(mlx5e_get_int_port_priv(flow->priv),
> +						      esw_attr->int_port);
> +			if (esw_attr->dest_int_port)
> +				mlx5e_tc_int_port_put(mlx5e_get_int_port_priv(flow->priv),
> +						      esw_attr->dest_int_port);
                                                      ^^^^^^^^^^^^^^^^^^^^^^^
[Severity: High]
Can this cause a double free of the mlx5e_tc_int_port object?

When parsing a multi-table action, mlx5e_clone_flow_attr_for_post_act()
performs a shallow copy of the primary attribute:

mlx5e_clone_flow_attr_for_post_act() {
	...
	memcpy(attr2, attr, attr_sz);
	...
}

This duplicates the dest_int_port and int_port pointers into the cloned
attribute without acquiring new references for them.

During flow deletion, mlx5e_tc_del_fdb_flow() already correctly puts the
primary attribute's dest_int_port, dropping the refcount and freeing the
internal port object:

mlx5e_tc_del_fdb_flow() {
	...
	if (esw_attr->dest_int_port)
		mlx5e_tc_int_port_put(mlx5e_get_int_port_priv(priv),
				      esw_attr->dest_int_port);
	...
}

Since the cloned attributes never took their own references, won't putting
the pointers again here in free_flow_post_acts() result in a use-after-free
and double free of the already-freed mlx5e_tc_int_port object?

> +		}
> +
>  		list_del(&attr->list);
>  		kvfree(attr->parse_attr);
>  		kfree(attr);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260924173505.87763-1-artem@trailofbits.com?part=1