Commit 884abe45 authored by Zhengchao Shao's avatar Zhengchao Shao Committed by Saeed Mahameed
Browse files

net/mlx5e: fix double free in mlx5e_destroy_flow_table 



In function accel_fs_tcp_create_groups(), when the ft->g memory is
successfully allocated but the 'in' memory fails to be allocated, the
memory pointed to by ft->g is released once. And in function
accel_fs_tcp_create_table, mlx5e_destroy_flow_table is called to release
the memory pointed to by ft->g again. This will cause double free problem.

Fixes: c062d52a ("net/mlx5e: Receive flow steering framework for accelerated TCP flows")
Signed-off-by: default avatarZhengchao Shao <shaozhengchao@huawei.com>
Signed-off-by: default avatarSaeed Mahameed <saeedm@nvidia.com>
parent c451410c

drivers/net/ethernet/mellanox/mlx5/core/en_accel/fs_tcp.c

+1 −0
Original line number Diff line number Diff line
@@ -190,6 +190,7 @@ static int accel_fs_tcp_create_groups(struct mlx5e_flow_table *ft, 
	in = kvzalloc(inlen, GFP_KERNEL);

	if  (!in || !ft->g) {

		kfree(ft->g);

		ft->g = NULL;

		kvfree(in);

		return -ENOMEM;

	}