[PATCH] RDMA/cache: fix invalid-free of flex-array data_vec in release_gid_table

[Deepanshu Kartikey <kartikey406@gmail.com>]

Commit 74e2711bb2af ("RDMA/core: Use kzalloc_flex for GID table")
converted alloc_gid_table() to use kzalloc_flex(), which allocates
the ib_gid_table struct and its trailing data_vec flex array member
in a single contiguous slab block.

However, release_gid_table() was not updated accordingly and still
calls kfree(table->data_vec), passing a pointer that points 216 bytes
into the middle of the slab object rather than its head. This is an
invalid free which KASAN catches as:

  BUG: KASAN: invalid-free in release_gid_table+0x384/0x470

Since data_vec is now a flex array member of ib_gid_table, it is
freed implicitly when kfree(table) is called. Remove the redundant
and invalid kfree(table->data_vec).

Fixes: 74e2711bb2af ("RDMA/core: Use kzalloc_flex for GID table")
Reported-by: syzbot+4334f9a250019c1b79b4@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=4334f9a250019c1b79b4
Tested-by: syzbot+4334f9a250019c1b79b4@syzkaller.appspotmail.com
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
 drivers/infiniband/core/cache.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/infiniband/core/cache.c b/drivers/infiniband/core/cache.c
index 896486fa6185..647a547e2d7f 100644
--- a/drivers/infiniband/core/cache.c
+++ b/drivers/infiniband/core/cache.c
@@ -801,7 +801,6 @@ static void release_gid_table(struct ib_device *device,
 	}
 
 	mutex_destroy(&table->lock);
-	kfree(table->data_vec);
 	kfree(table);
 }
 
-- 
2.43.0