Commit 9b0ceca5 authored by Zhipeng Lu's avatar Zhipeng Lu Committed by Chen Zhongjin
Browse files

net/mlx5e: fix a double-free in arfs_create_groups 

mainline inclusion
from mainline-v6.8-rc2
commit 3c6d5189246f590e4e1f167991558bdb72a4738b
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9Q9IE
CVE: CVE-2024-35835

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3c6d5189246f590e4e1f167991558bdb72a4738b



--------------------------------

When `in` allocated by kvzalloc fails, arfs_create_groups will free
ft->g and return an error. However, arfs_create_table, the only caller of
arfs_create_groups, will hold this error and call to
mlx5e_destroy_flow_table, in which the ft->g will be freed again.

Fixes: 1cabe6b0 ("net/mlx5e: Create aRFS flow tables")
Signed-off-by: default avatarZhipeng Lu <alexious@zju.edu.cn>
Reviewed-by: default avatarSimon Horman <horms@kernel.org>
Signed-off-by: default avatarSaeed Mahameed <saeedm@nvidia.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Conflicts:
	drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c
[fix context conflicts]
Signed-off-by: default avatarChen Zhongjin <chenzhongjin@huawei.com>
parent 80ab23a8

drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c

+15 −11
Original line number Diff line number Diff line
@@ -233,11 +233,13 @@ static int arfs_create_groups(struct mlx5e_flow_table *ft, 


	ft->g = kcalloc(MLX5E_ARFS_NUM_GROUPS,

			sizeof(*ft->g), GFP_KERNEL);

	in = kvzalloc(inlen, GFP_KERNEL);

	if  (!in || !ft->g) {

		kvfree(ft->g);

		kvfree(in);

	if (!ft->g)

		return -ENOMEM;



	in = kvzalloc(inlen, GFP_KERNEL);

	if (!in) {

		err = -ENOMEM;

		goto err_free_g;

	}



	mc = MLX5_ADDR_OF(create_flow_group_in, in, match_criteria);
@@ -257,7 +259,7 @@ static int arfs_create_groups(struct mlx5e_flow_table *ft, 
		break;

	default:

		err = -EINVAL;

		goto out;

		goto err_free_in;

	}



	switch (type) {
@@ -279,7 +281,7 @@ static int arfs_create_groups(struct mlx5e_flow_table *ft, 
		break;

	default:

		err = -EINVAL;

		goto out;

		goto err_free_in;

	}



	MLX5_SET_CFG(in, match_criteria_enable, MLX5_MATCH_OUTER_HEADERS);
@@ -288,7 +290,7 @@ static int arfs_create_groups(struct mlx5e_flow_table *ft, 
	MLX5_SET_CFG(in, end_flow_index, ix - 1);

	ft->g[ft->num_groups] = mlx5_create_flow_group(ft->t, in);

	if (IS_ERR(ft->g[ft->num_groups]))

		goto err;

		goto err_clean_group;

	ft->num_groups++;



	memset(in, 0, inlen);
@@ -297,18 +299,20 @@ static int arfs_create_groups(struct mlx5e_flow_table *ft, 
	MLX5_SET_CFG(in, end_flow_index, ix - 1);

	ft->g[ft->num_groups] = mlx5_create_flow_group(ft->t, in);

	if (IS_ERR(ft->g[ft->num_groups]))

		goto err;

		goto err_clean_group;

	ft->num_groups++;



	kvfree(in);

	return 0;



err:

err_clean_group:

	err = PTR_ERR(ft->g[ft->num_groups]);

	ft->g[ft->num_groups] = NULL;

out:

err_free_in:

	kvfree(in);



err_free_g:

	kfree(ft->g);

	ft->g = NULL;

	return err;

}