Skip to content

Commit

Permalink
net/mlx5e: fix double free in mlx5e_destroy_flow_table
Browse files Browse the repository at this point in the history
In function accel_fs_tcp_create_groups(), when the ft->g memory is
successfully allocated but the 'in' memory fails to be allocated, the
memory pointed to by ft->g is released once. And in function
accel_fs_tcp_create_table, mlx5e_destroy_flow_table is called to release
the memory pointed to by ft->g again. This will cause double free problem.

Fixes: c062d52 ("net/mlx5e: Receive flow steering framework for accelerated TCP flows")
Signed-off-by: Zhengchao Shao <[email protected]>
Signed-off-by: Saeed Mahameed <[email protected]>
  • Loading branch information
zhengchaoshao authored and Saeed Mahameed committed Jul 5, 2023
1 parent c451410 commit 884abe4
Showing 1 changed file with 1 addition and 0 deletions.
1 change: 1 addition & 0 deletions drivers/net/ethernet/mellanox/mlx5/core/en_accel/fs_tcp.c
Original file line number Diff line number Diff line change
Expand Up @@ -190,6 +190,7 @@ static int accel_fs_tcp_create_groups(struct mlx5e_flow_table *ft,
in = kvzalloc(inlen, GFP_KERNEL);
if (!in || !ft->g) {
kfree(ft->g);
ft->g = NULL;
kvfree(in);
return -ENOMEM;
}
Expand Down

0 comments on commit 884abe4

Please sign in to comment.