From: Saeed Mahameed <saeed@kernel.org>
To: Dust Li <dust.li@linux.alibaba.com>
Cc: Saeed Mahameed <saeedm@nvidia.com>,
Leon Romanovsky <leon@kernel.org>,
"David S. Miller" <davem@davemloft.net>,
Eric Dumazet <edumazet@google.com>,
Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>,
netdev@vger.kernel.org, linux-rdma@vger.kernel.org,
linux-kernel@vger.kernel.org,
Cruz Zhao <cruzzhao@linux.alibaba.com>,
Tianchen Ding <dtcccc@linux.alibaba.com>
Subject: Re: [PATCH net] net/mlx5e: fix double free of encap_header
Date: Thu, 26 Oct 2023 16:00:00 -0700 [thread overview]
Message-ID: <ZTrvcHEC/rU1G4ct@x130> (raw)
In-Reply-To: <20231025032712.79026-1-dust.li@linux.alibaba.com>
On 25 Oct 11:27, Dust Li wrote:
>When mlx5_packet_reformat_alloc() fails, the encap_header allocated in
>mlx5e_tc_tun_create_header_ipv4{6} will be released within it. However,
>e->encap_header is already set to the previously freed encap_header
>before mlx5_packet_reformat_alloc(). As a result, the later
>mlx5e_encap_put() will free e->encap_header again, causing a double free
>issue.
>
>mlx5e_encap_put()
> --> mlx5e_encap_dealloc()
> --> kfree(e->encap_header)
>
>This happens when cmd: MLX5_CMD_OP_ALLOC_PACKET_REFORMAT_CONTEXT fail.
>
>This patch fix it by not setting e->encap_header until
>mlx5_packet_reformat_alloc() success.
>
>Fixes: d589e785baf5e("net/mlx5e: Allow concurrent creation of encap entries")
>Reported-by: Cruz Zhao <cruzzhao@linux.alibaba.com>
>Reported-by: Tianchen Ding <dtcccc@linux.alibaba.com>
>Signed-off-by: Dust Li <dust.li@linux.alibaba.com>
Applied to net-mlx5
prev parent reply other threads:[~2023-10-26 23:00 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-10-25 3:27 [PATCH net] net/mlx5e: fix double free of encap_header Dust Li
2023-10-25 9:06 ` Wojciech Drewek
2023-10-27 6:58 ` Dust Li
2023-10-26 23:00 ` Saeed Mahameed [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ZTrvcHEC/rU1G4ct@x130 \
--to=saeed@kernel.org \
--cc=cruzzhao@linux.alibaba.com \
--cc=davem@davemloft.net \
--cc=dtcccc@linux.alibaba.com \
--cc=dust.li@linux.alibaba.com \
--cc=edumazet@google.com \
--cc=kuba@kernel.org \
--cc=leon@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-rdma@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=saeedm@nvidia.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.