diff options
| author | Zhengchao Shao <shaozhengchao@huawei.com> | 2023-06-28 08:59:34 +0800 |
|---|---|---|
| committer | Saeed Mahameed <saeedm@nvidia.com> | 2023-07-05 10:57:02 -0700 |
| commit | 884abe45a9014d0de2e6edb0630dfd64f23f1d1b (patch) | |
| tree | 5e18f7f3f62a3f2b07024ccfb9d4fade020db19d /drivers/net/ethernet/mellanox/mlx5/core/en_accel | |
| parent | c451410ca7e3d8eeb31d141fc20c200e21754ba4 (diff) | |
net/mlx5e: fix double free in mlx5e_destroy_flow_table
In function accel_fs_tcp_create_groups(), when the ft->g memory is
successfully allocated but the 'in' memory fails to be allocated, the
memory pointed to by ft->g is released once. And in function
accel_fs_tcp_create_table, mlx5e_destroy_flow_table is called to release
the memory pointed to by ft->g again. This will cause double free problem.
Fixes: c062d52ac24c ("net/mlx5e: Receive flow steering framework for accelerated TCP flows")
Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Diffstat (limited to 'drivers/net/ethernet/mellanox/mlx5/core/en_accel')
| -rw-r--r-- | drivers/net/ethernet/mellanox/mlx5/core/en_accel/fs_tcp.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/fs_tcp.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/fs_tcp.c index 88a5aed9d678..c7d191f66ad1 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/fs_tcp.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/fs_tcp.c @@ -190,6 +190,7 @@ static int accel_fs_tcp_create_groups(struct mlx5e_flow_table *ft, in = kvzalloc(inlen, GFP_KERNEL); if (!in || !ft->g) { kfree(ft->g); + ft->g = NULL; kvfree(in); return -ENOMEM; } |