Re: [PATCH] [v3] net/mlx5e: fix a double-free in arfs_create_groups

[Simon Horman]

On Fri, Jan 12, 2024 at 03:29:16PM +0800, Zhipeng Lu wrote:
> When `in` allocated by kvzalloc fails, arfs_create_groups will free
> ft->g and return an error. However, arfs_create_table, the only caller of
> arfs_create_groups, will hold this error and call to
> mlx5e_destroy_flow_table, in which the ft->g will be freed again.
> 
> Fixes: 1cabe6b0965e ("net/mlx5e: Create aRFS flow tables")
> Signed-off-by: Zhipeng Lu <alexious@xxxxxxxxxx>

Thanks, I think this is getting close.

Can you please prepare a v4 with the nits below fixed?
And please target at the 'net' tree, by making sure it
is based on the main branch of that tree, and marking
the subject as follows:

	Subject: [PATCH net v3] ...

> ---
> Changelog:
> 
> v2: free ft->g just in arfs_create_groups with a unwind ladder.
> v3: split the allocation of ft->g and in. Rename the error label.
>     remove some refector change in v2.
> ---
>  .../net/ethernet/mellanox/mlx5/core/en_arfs.c | 26 +++++++++++--------
>  1 file changed, 15 insertions(+), 11 deletions(-)
> 
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c
> index bb7f86c993e5..0424ae068a60 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c
> @@ -254,11 +254,13 @@ static int arfs_create_groups(struct mlx5e_flow_table *ft,
>  
>  	ft->g = kcalloc(MLX5E_ARFS_NUM_GROUPS,
>  			sizeof(*ft->g), GFP_KERNEL);
> -	in = kvzalloc(inlen, GFP_KERNEL);
> -	if  (!in || !ft->g) {
> -		kfree(ft->g);
> -		kvfree(in);
> +	if(!ft->g)

nit: (one) space after if, please

>  		return -ENOMEM;
> +
> +	in = kvzalloc(inlen, GFP_KERNEL);
> +	if  (!in) {

nit: one space is enough after if

> +		err = -ENOMEM;
> +		goto err_free_g;
>  	}
>  
>  	mc = MLX5_ADDR_OF(create_flow_group_in, in, match_criteria);

..