Re: [PATCH] dpaa2-switch: Fix memory leak in dpaa2_switch_acl_entry_add() and dpaa2_switch_acl_entry_remove()

[Vladimir Oltean <olteanv@gmail.com>]

Hi Yuan,

On Mon, Dec 05, 2022 at 06:15:15AM +0000, Yuan Can wrote:
> The cmd_buff needs to be freed when error happened in
> dpaa2_switch_acl_entry_add() and dpaa2_switch_acl_entry_remove().
> 
> Fixes: 1110318d83e8 ("dpaa2-switch: add tc flower hardware offload on ingress traffic")
> Signed-off-by: Yuan Can <yuancan@huawei.com>
> ---
>  drivers/net/ethernet/freescale/dpaa2/dpaa2-switch-flower.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch-flower.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch-flower.c
> index cacd454ac696..c39b866e2582 100644
> --- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch-flower.c
> +++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch-flower.c
> @@ -132,6 +132,7 @@ int dpaa2_switch_acl_entry_add(struct dpaa2_switch_filter_block *filter_block,
>  						 DMA_TO_DEVICE);
>  	if (unlikely(dma_mapping_error(dev, acl_entry_cfg->key_iova))) {
>  		dev_err(dev, "DMA mapping failed\n");
> +		kfree(cmd_buff);
>  		return -EFAULT;
>  	}
>  
> @@ -142,6 +143,7 @@ int dpaa2_switch_acl_entry_add(struct dpaa2_switch_filter_block *filter_block,
>  			 DMA_TO_DEVICE);
>  	if (err) {
>  		dev_err(dev, "dpsw_acl_add_entry() failed %d\n", err);
> +		kfree(cmd_buff);

To reduce the number of kfree() calls, this last one can be put right
before checking for error, and we could remove the kfree(cmd_buff) call at
the very end. I mean that was already the intention, if you look at the
dma_unmap_single() call compared to the error checking. Like this:

	err = dpsw_acl_add_entry(...);

	dma_unmap_single(dev, acl_entry_cfg->key_iova, sizeof(cmd_buff),
			 DMA_TO_DEVICE);
	kfree(cmd_buff);

	if (err) {
		dev_err(dev, "dpsw_acl_add_entry() failed %d\n", err);
		return err;
	}

	return 0;
}

>  		return err;
>  	}
>  
> @@ -172,6 +174,7 @@ dpaa2_switch_acl_entry_remove(struct dpaa2_switch_filter_block *block,
>  						 DMA_TO_DEVICE);
>  	if (unlikely(dma_mapping_error(dev, acl_entry_cfg->key_iova))) {
>  		dev_err(dev, "DMA mapping failed\n");
> +		kfree(cmd_buff);
>  		return -EFAULT;
>  	}
>  
> @@ -182,6 +185,7 @@ dpaa2_switch_acl_entry_remove(struct dpaa2_switch_filter_block *block,
>  			 DMA_TO_DEVICE);
>  	if (err) {
>  		dev_err(dev, "dpsw_acl_remove_entry() failed %d\n", err);
> +		kfree(cmd_buff);

Similar here:

	err = dpsw_acl_remove_entry(ethsw->mc_io, 0, ethsw->dpsw_handle,
				    block->acl_id, acl_entry_cfg);

	dma_unmap_single(dev, acl_entry_cfg->key_iova, sizeof(cmd_buff),
			 DMA_TO_DEVICE);
	kfree(cmd_buff);

	if (err) {
		dev_err(dev, "dpsw_acl_remove_entry() failed %d\n", err);
		return err;
	}

	return 0;
}

>  		return err;
>  	}
>  
> -- 
> 2.17.1
>