[PATCH net 0/2] fix two memory leak issues for mlx5en driver

[PATCH net 0/2] fix two memory leak issues for mlx5en driver

[Zhengchao Shao]

Fix two memory leak issues for mlx5en driver:
1. fix memory leak in mlx5e_fs_tt_redirect_any_create
2. fix memory leak in mlx5e_ptp_open

Zhengchao Shao (2):
  net/mlx5e: fix memory leak in mlx5e_fs_tt_redirect_any_create
  net/mlx5e: fix memory leak in mlx5e_ptp_open

 drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c | 4 ++--
 drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c            | 6 ++++--
 2 files changed, 6 insertions(+), 4 deletions(-)

-- 
2.34.1

[PATCH net 1/2] net/mlx5e: fix memory leak in mlx5e_fs_tt_redirect_any_create

[Zhengchao Shao]

The memory pointed to by the fs->any pointer is not freed in the error
path of mlx5e_fs_tt_redirect_any_create, which can lead to a memory leak.
Fix by freeing the memory in the error path, thereby making the error path
identical to mlx5e_fs_tt_redirect_any_destroy().

Fixes: 0f575c20bf06 ("net/mlx5e: Introduce Flow Steering ANY API")
Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
---
 drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c b/drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c
index 03cb79adf912..9cf4ec931b8b 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c
@@ -594,7 +594,7 @@ int mlx5e_fs_tt_redirect_any_create(struct mlx5e_flow_steering *fs)
 
 	err = fs_any_create_table(fs);
 	if (err)
-		return err;
+		goto err_free_any;
 
 	err = fs_any_enable(fs);
 	if (err)
@@ -606,7 +606,7 @@ int mlx5e_fs_tt_redirect_any_create(struct mlx5e_flow_steering *fs)
 
 err_destroy_table:
 	fs_any_destroy_table(fs_any);
-
+err_free_any:
 	kfree(fs_any);
 	mlx5e_fs_set_any(fs, NULL);
 	return err;
-- 
2.34.1

[PATCH net 2/2] net/mlx5e: fix memory leak in mlx5e_ptp_open

[Zhengchao Shao]

When kvzalloc_node or kvzalloc failed in mlx5e_ptp_open, the memory
pointed by "c" or "cparams" is not freed, which can lead to a memory
leak. Fix by freeing the array in the error path.

Fixes: 145e5637d941 ("net/mlx5e: Add TX PTP port object support")
Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
---
 drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c b/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c
index 3cbebfba582b..b0b429a0321e 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c
@@ -729,8 +729,10 @@ int mlx5e_ptp_open(struct mlx5e_priv *priv, struct mlx5e_params *params,
 
 	c = kvzalloc_node(sizeof(*c), GFP_KERNEL, dev_to_node(mlx5_core_dma_dev(mdev)));
 	cparams = kvzalloc(sizeof(*cparams), GFP_KERNEL);
-	if (!c || !cparams)
-		return -ENOMEM;
+	if (!c || !cparams) {
+		err = -ENOMEM;
+		goto err_free;
+	}
 
 	c->priv     = priv;
 	c->mdev     = priv->mdev;
-- 
2.34.1

Re: [PATCH net 2/2] net/mlx5e: fix memory leak in mlx5e_ptp_open

[Gal Pressman]

On 29/06/2023 5:46, Zhengchao Shao wrote:
> When kvzalloc_node or kvzalloc failed in mlx5e_ptp_open, the memory
> pointed by "c" or "cparams" is not freed, which can lead to a memory
> leak. Fix by freeing the array in the error path.
> 
> Fixes: 145e5637d941 ("net/mlx5e: Add TX PTP port object support")
> Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>

Thanks Zhengchao!
Reviewed-by: Gal Pressman <gal@nvidia.com>

Re: [PATCH net 2/2] net/mlx5e: fix memory leak in mlx5e_ptp_open

[Rahul Rameshbabu]

On Thu, 29 Jun, 2023 10:46:42 +0800 Zhengchao Shao <shaozhengchao@huawei.com> wrote:
> When kvzalloc_node or kvzalloc failed in mlx5e_ptp_open, the memory
> pointed by "c" or "cparams" is not freed, which can lead to a memory
> leak. Fix by freeing the array in the error path.

Reviewed-by: Rahul Rameshbabu <rrameshbabu@nvidia.com>

Re: [PATCH net 1/2] net/mlx5e: fix memory leak in mlx5e_fs_tt_redirect_any_create

[Simon Horman]

On Thu, Jun 29, 2023 at 10:46:41AM +0800, Zhengchao Shao wrote:
> The memory pointed to by the fs->any pointer is not freed in the error
> path of mlx5e_fs_tt_redirect_any_create, which can lead to a memory leak.
> Fix by freeing the memory in the error path, thereby making the error path
> identical to mlx5e_fs_tt_redirect_any_destroy().
> 
> Fixes: 0f575c20bf06 ("net/mlx5e: Introduce Flow Steering ANY API")
> Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>

Reviewed-by: Simon Horman <simon.horman@corigine.com>

Re: [PATCH net 1/2] net/mlx5e: fix memory leak in mlx5e_fs_tt_redirect_any_create

[Rahul Rameshbabu]

On Thu, 29 Jun, 2023 10:46:41 +0800 Zhengchao Shao <shaozhengchao@huawei.com> wrote:
> The memory pointed to by the fs->any pointer is not freed in the error
> path of mlx5e_fs_tt_redirect_any_create, which can lead to a memory leak.
> Fix by freeing the memory in the error path, thereby making the error path
> identical to mlx5e_fs_tt_redirect_any_destroy().
>
> Fixes: 0f575c20bf06 ("net/mlx5e: Introduce Flow Steering ANY API")
> Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
> ---
>  drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c b/drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c
> index 03cb79adf912..9cf4ec931b8b 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c
> @@ -594,7 +594,7 @@ int mlx5e_fs_tt_redirect_any_create(struct mlx5e_flow_steering *fs)
>  
>  	err = fs_any_create_table(fs);
>  	if (err)
> -		return err;
> +		goto err_free_any;
>  
>  	err = fs_any_enable(fs);
>  	if (err)
> @@ -606,7 +606,7 @@ int mlx5e_fs_tt_redirect_any_create(struct mlx5e_flow_steering *fs)
>  
>  err_destroy_table:
>  	fs_any_destroy_table(fs_any);
> -
> +err_free_any:
>  	kfree(fs_any);
>  	mlx5e_fs_set_any(fs, NULL);

We probably should update the 'any' member reference in fs to NULL
*before* free-ing fs_any. Otherwise, there is a period in time where fs
is referring to a dirty pointer value in its any member field. It's not
critical, but it makes logical sense in my opinion. Lets swap these two
lines in this patch.

>  	return err;

Thanks for the patch,

-- Rahul Rameshbabu

Re: [PATCH net 1/2] net/mlx5e: fix memory leak in mlx5e_fs_tt_redirect_any_create

[shaozhengchao]

On 2023/6/30 2:18, Rahul Rameshbabu wrote:
> On Thu, 29 Jun, 2023 10:46:41 +0800 Zhengchao Shao <shaozhengchao@huawei.com> wrote:
>> The memory pointed to by the fs->any pointer is not freed in the error
>> path of mlx5e_fs_tt_redirect_any_create, which can lead to a memory leak.
>> Fix by freeing the memory in the error path, thereby making the error path
>> identical to mlx5e_fs_tt_redirect_any_destroy().
>>
>> Fixes: 0f575c20bf06 ("net/mlx5e: Introduce Flow Steering ANY API")
>> Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
>> ---
>>   drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c | 4 ++--
>>   1 file changed, 2 insertions(+), 2 deletions(-)
>>
>> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c b/drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c
>> index 03cb79adf912..9cf4ec931b8b 100644
>> --- a/drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c
>> +++ b/drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c
>> @@ -594,7 +594,7 @@ int mlx5e_fs_tt_redirect_any_create(struct mlx5e_flow_steering *fs)
>>   
>>   	err = fs_any_create_table(fs);
>>   	if (err)
>> -		return err;
>> +		goto err_free_any;
>>   
>>   	err = fs_any_enable(fs);
>>   	if (err)
>> @@ -606,7 +606,7 @@ int mlx5e_fs_tt_redirect_any_create(struct mlx5e_flow_steering *fs)
>>   
>>   err_destroy_table:
>>   	fs_any_destroy_table(fs_any);
>> -
>> +err_free_any:
>>   	kfree(fs_any);
>>   	mlx5e_fs_set_any(fs, NULL);
> 
Hi Rahul:
> We probably should update the 'any' member reference in fs to NULL
> *before* free-ing fs_any. Otherwise, there is a period in time where fs
> is referring to a dirty pointer value in its any member field. It's not
> critical, but it makes logical sense in my opinion. Lets swap these two
> lines in this patch.
> 
	It looks good. I will send V2. Thank you.

Zhengchao Shao
>>   	return err;
> 
> Thanks for the patch,
> 
> -- Rahul Rameshbabu