From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f50.google.com (mail-wm1-f50.google.com [209.85.128.50]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0BF2036B044 for ; Fri, 1 May 2026 23:20:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.50 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777677640; cv=none; b=WtmB3/UP1mnTUZN/4ws9Zrs2Am5vsz526OZjgu1kk6dYx5BVBA3a6PhTIWDyoBZ3wDIhV+lZc8Gncj9Bq4+6FQ47Prd82zNt3RLeKSPrTiefbfMAKi+dqSYFvUYLzdvcfCMJJGg9Z3XNewrk+N+wgSYEwo/3WqztfLRsd7njtjQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777677640; c=relaxed/simple; bh=sTKHrcsmYbMcWsLC1yGTiQpud1Y4vAojqIbF4kwh9cE=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Y7xAjkZCEO1RhyU7YzJQ/H/Zto5LA5o1eWdGTpxenwdDfIsqwzhOuyRXUrf7qQ1QJhreKvH1GSfS0nIvxxf2ZLT96xlPMusJHe6pTkt+rutjH+kfT7uCeyJbXozKOH9B1+3tb/dXp9Zpq3e3iumA+9+BOuqcHGwuJ9x2prAJ1Iw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=mJ28x1fY; arc=none smtp.client-ip=209.85.128.50 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="mJ28x1fY" Received: by mail-wm1-f50.google.com with SMTP id 5b1f17b1804b1-483487335c2so25095695e9.2 for ; Fri, 01 May 2026 16:20:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1777677637; x=1778282437; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=RKEaF2iRw0R0guzHvQGGi1fNA7z9KrsHAT4UjhLPp+c=; b=mJ28x1fY3/1DwAJ3P1/6TAw2KcUtvAa2sYg1gBkjhFGKsK3sVJnkAhz8cN5VMYscDr Y2Dk5/YPRxyJ24MBZjmvPW7jvGNdfL//t/Gulaex2Swr58oJ64mxYe78AZtXPfOwba1E VKB0s6rIAr7HdoRbzrVNYAMV7c1A4PtQFpUPPUpAG+EBvT85hjtad75a+bZmQIJWiOrI 16rOWroXFBSDivSy4L6Rxd3HRcgzp6lIKywY575slZOFa9RswXXiEXxouwLprCGkkqYg D3iUi1TgHMCsg4/hYFF/lpZMacdirI+ZObSvxOil10p3ZpMh14Z83vY8k8QdZ4bG77j0 Xj0w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1777677637; x=1778282437; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=RKEaF2iRw0R0guzHvQGGi1fNA7z9KrsHAT4UjhLPp+c=; b=NFLw6bo7hTSFRZ3OXWEBneUnzY+Rs0SsFdOqLb+T5SdwaC/ffPeuaCJfbZaAaXHsrK NPpeBf6Tr5ipYIYSYqufGV91jzNjodorfQyKD0Sq9JwmfoC0e3zGe6e0dHkoc/fYRUfb uybUv3SwCt0vxKBfIf96jfj14ho8IvunKJ9CqDlRs9cxWy5o3mvyAX8H723e5wDjYhNR ESuShIkPSJ3hKd3QVbllfYzw7kGbhddO/8wNbSm/o5VktMDFbpcPkH6w4LY3VRsie912 pbnq0/OHoLFUqOhHLTf0e0aZdvGYgjPzwtayX/nL1nqkx8s0zxJgo4wPV+DLwW93MUzu TcIw== X-Forwarded-Encrypted: i=1; AFNElJ+MGbyItUvme2dis91jBbRk8giXE/eGPNH/MJxY3Wcx9I/Ti4SbH//39L1ra9NFkR23rzEqJEH5UFIrD6g=@vger.kernel.org X-Gm-Message-State: AOJu0YwlB5Jng6Dt7zDcRGQlGhDGPb4DEoxVGLbdpngalstTJ6H0lO8s cgVYOd+p4zZ0wwOWD4JKRW3DQD1/0/lsh8+B24kiNxtL9XBOQvZsu6vz X-Gm-Gg: AeBDieuIzeyblLtxgRzZreveM55teyVav8uhN+LbgYVchavY4mTrDqkUa/2fpo/OYjv vQxnXMsK+1bqufTOjSaImNzucASJ8rdCnz6OtJUy2AfOhFCS0G8ZBv88oV3wmP1E6QY4l9TaoZX G5FlxI4OjWRsMCo2l+jYUK5zTU6oQ4LkAVP8ut+SliovN7FF73+pFyS8ArmJL0Oh7ngyglG5zr9 yUdObJJehidxymqzGryd9c1cu5g0vZwy1sdNmeimc1zDQLQjcajw/Ayq31M19shEzhq07nIaK3Y uhgZnOZcOJCmov5DeWdqDYzEO867zQygFtJ4PFV/15ET4qqUD6Zu7p15q+KHyUmVIF4K+aP4IgY mcIh+o8yL1K9qsQQ4Z0gSzwI5ec794eYFhnJOgMaQ62etsXudDzAEianm1XLW1W3dSetTr/woNb 4mBlrg6Wh/+ZGZ2RbemLg743V0MY/w8ElvOFowUELZBv2/Pu/NMx4/t8CxqweiquatyzKgcNNja iScYeXdIVRTVX5Yk67m3kXj5i6GGa6GuG0kt/bmVg== X-Received: by 2002:a05:600c:5297:b0:48a:5565:ec3d with SMTP id 5b1f17b1804b1-48a988a78d3mr14510395e9.22.1777677637405; Fri, 01 May 2026 16:20:37 -0700 (PDT) Received: from SD.localdomain (heme-13-b2-v4wan-167795-cust403.vm32.cable.virginm.net. [81.108.45.148]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-48a8ebb2fa5sm72414955e9.12.2026.05.01.16.20.33 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 01 May 2026 16:20:35 -0700 (PDT) From: Prathamesh Deshpande To: Saeed Mahameed , Leon Romanovsky , Tariq Toukan Cc: mbloch@nvidia.com, shayd@nvidia.com, andrew+netdev@lunn.ch, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, netdev@vger.kernel.org, linux-rdma@vger.kernel.org, linux-kernel@vger.kernel.org, Prathamesh Deshpande Subject: [PATCH net v1] net/mlx5: Fix flow steering alloc unwind Date: Sat, 2 May 2026 00:20:29 +0100 Message-ID: <20260501232031.41688-1-prathameshdeshpande7@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit mlx5_fs_core_alloc() uses mlx5_fs_core_free() for its common error path, but mlx5_fs_core_free() dereferences dev->priv.steering. If mlx5_ft_pool_init() fails, or if allocating the steering object fails, dev->priv.steering has not been assigned yet. The error path can then dereference NULL while unwinding the original failure. Split the unwind paths so only resources that were successfully initialized are released. Fixes: b33886971dbc ("net/mlx5: Initialize flow steering during driver probe") Signed-off-by: Prathamesh Deshpande --- .../net/ethernet/mellanox/mlx5/core/fs_core.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c index 61a6ba1e49dd..e1662dcedbf4 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c @@ -3984,12 +3984,12 @@ int mlx5_fs_core_alloc(struct mlx5_core_dev *dev) err = mlx5_ft_pool_init(dev); if (err) - goto err; + goto err_fc_stats; steering = kzalloc_obj(*steering); if (!steering) { err = -ENOMEM; - goto err; + goto err_ft_pool; } steering->dev = dev; @@ -4011,13 +4011,19 @@ int mlx5_fs_core_alloc(struct mlx5_core_dev *dev) 0, NULL); if (!steering->ftes_cache || !steering->fgs_cache) { err = -ENOMEM; - goto err; + goto err_fs_core; } return 0; -err: - mlx5_fs_core_free(dev); +err_fs_core: + kmem_cache_destroy(steering->ftes_cache); + kmem_cache_destroy(steering->fgs_cache); + kfree(steering); +err_ft_pool: + mlx5_ft_pool_destroy(dev); +err_fc_stats: + mlx5_cleanup_fc_stats(dev); return err; } -- 2.43.0