net/mlx5e: Fix two double free cases
commit5.4-rM2-2.2.x-imx-squashed7a6eb072a9
upstream. mlx5e_create_ttc_table_groups() frees ft->g on failure of kvzalloc(), but such failure will be caught by its caller in mlx5e_create_ttc_table() and ft->g will be freed again in mlx5e_destroy_flow_table(). The same issue also occurs in mlx5e_create_ttc_table_groups(). Set ft->g to NULL after kfree() to avoid double free. Fixes:7b3722fa9e
("net/mlx5e: Support RSS for GRE tunneled packets") Fixes:33cfaaa8f3
("net/mlx5e: Split the main flow steering table") Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn> Reviewed-by: Leon Romanovsky <leonro@nvidia.com> Signed-off-by: Saeed Mahameed <saeedm@nvidia.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
parent
ce74b5a068
commit
c3c7748867
|
@ -927,6 +927,7 @@ static int mlx5e_create_ttc_table_groups(struct mlx5e_ttc_table *ttc,
|
|||
in = kvzalloc(inlen, GFP_KERNEL);
|
||||
if (!in) {
|
||||
kfree(ft->g);
|
||||
ft->g = NULL;
|
||||
return -ENOMEM;
|
||||
}
|
||||
|
||||
|
@ -1067,6 +1068,7 @@ static int mlx5e_create_inner_ttc_table_groups(struct mlx5e_ttc_table *ttc)
|
|||
in = kvzalloc(inlen, GFP_KERNEL);
|
||||
if (!in) {
|
||||
kfree(ft->g);
|
||||
ft->g = NULL;
|
||||
return -ENOMEM;
|
||||
}
|
||||
|
||||
|
|
Loading…
Reference in New Issue