From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by smtp.subspace.kernel.org (Postfix) with ESMTPS id B84B258133;
	Thu, 30 Nov 2023 17:44:15 +0000 (UTC)
Authentication-Results: smtp.subspace.kernel.org;
	dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="OTsVvuxq"
Received: by smtp.kernel.org (Postfix) with ESMTPSA id 89A85C433C9;
	Thu, 30 Nov 2023 17:44:12 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org;
	s=k20201202; t=1701366255;
	bh=uzTkHarOhWkDRPyS2TS5VgefjyqziPWu4KYGuOmUCMY=;
	h=Date:From:To:Cc:Subject:References:In-Reply-To:From;
	b=OTsVvuxqonWfqBPO3LoEoMMLCu6SuUZ07G3eOHFqcWj3z9ozDz/7GMiQBpASmAJIC
	 9m+cZ8/+8di3YeHnM7QoI9MfKzrJWZQEGCTrPvhTdbjh9wyWejnjZEcIz8+Wnk+sAF
	 ic2/WU+BROUoRffGvaaOGUSyGpDEEZBEmJOE8nxCsEkUSS1sv4r599lUvRXiw2/KVz
	 h4kUDSsiH2NgvfYfHpWErG4UN++6dJMUilSav2USnSh2QYlZSyi/YHDsnMXdHhR5gG
	 +RZA6Aq2ExhTYr2wwsZzLCDAuKrGst83xA+j5ILt8gGpTHXfk9IimKN0Vyq3Xodwsc
	 IcGTJaldjbQkQ==
Date: Thu, 30 Nov 2023 17:44:10 +0000
From: Simon Horman <horms@kernel.org>
To: Dinghao Liu <dinghao.liu@zju.edu.cn>
Cc: Saeed Mahameed <saeedm@nvidia.com>, Leon Romanovsky <leon@kernel.org>,
	"David S. Miller" <davem@davemloft.net>,
	Eric Dumazet <edumazet@google.com>,
	Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>,
	Rahul Rameshbabu <rrameshbabu@nvidia.com>,
	Zhengchao Shao <shaozhengchao@huawei.com>,
	Aya Levin <ayal@nvidia.com>, Tariq Toukan <tariqt@nvidia.com>,
	netdev@vger.kernel.org, linux-rdma@vger.kernel.org,
	linux-kernel@vger.kernel.org
Subject: Re: [PATCH] [v2] net/mlx5e: fix a potential double-free in
 fs_any_create_groups
Message-ID: <20231130174410.GJ32077@kernel.org>
References: <20231128092904.2916-1-dinghao.liu@zju.edu.cn>
Precedence: bulk
X-Mailing-List: netdev@vger.kernel.org
List-Id: <netdev.vger.kernel.org>
List-Subscribe: <mailto:netdev+subscribe@vger.kernel.org>
List-Unsubscribe: <mailto:netdev+unsubscribe@vger.kernel.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20231128092904.2916-1-dinghao.liu@zju.edu.cn>

On Tue, Nov 28, 2023 at 05:29:01PM +0800, Dinghao Liu wrote:
> When kcalloc() for ft->g succeeds but kvzalloc() for in fails,
> fs_any_create_groups() will free ft->g. However, its caller
> fs_any_create_table() will free ft->g again through calling
> mlx5e_destroy_flow_table(), which will lead to a double-free.
> Fix this by setting ft->g to NULL in fs_any_create_groups().
> 
> Fixes: 0f575c20bf06 ("net/mlx5e: Introduce Flow Steering ANY API")
> Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
> ---
> 
> Changelog:
> 
> v2: Setting ft->g to NULL instead of removing the kfree().

Reviewed-by: Simon Horman <horms@kernel.org>