From patchwork Mon Dec 25 11:29:14 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Zhipeng Lu X-Patchwork-Id: 183178 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a05:7301:6f82:b0:100:9c79:88ff with SMTP id tb2csp350502dyb; Mon, 25 Dec 2023 03:47:47 -0800 (PST) X-Google-Smtp-Source: AGHT+IGur6aymPC1qC11t9YQMLGT5mtPbhYQzVgBFOckNsw8vJU/I5f9fQgE192yOuET4uTwjlTc X-Received: by 2002:a17:903:18e:b0:1d4:2330:858f with SMTP id z14-20020a170903018e00b001d42330858fmr6201047plg.23.1703504867314; Mon, 25 Dec 2023 03:47:47 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1703504867; cv=none; d=google.com; s=arc-20160816; b=p3e1SAWPa8QK2ZoScO+DnWVUCrwCuz6XENkIUrreZRPMu3FGohAyOzhDCDxQeWKFJI x+ZqEa98L6uvHB6svBo6IN4eUPxOKd+R97ZKO6plQnQilJKRk8ZgMRT+VwpM2js4xYZs cfmbX0sWizGfEyJzqOBlR4Ox+GwnJxNssMJTsiYieA/BgMCQ+pvWgyDaB+2iTZ6bLoQm n3LYeWCWKO+x+Dwp+Qllf3SkhkqNPJMkpVz+T4GX8KxnbLqDx3n/fg1qiNIJd8OYaRAk exQHEDM0nZISK6atbiq7AocBpeX78z5g6nmyWL2GGG+a9DHiFWVwir5sXH9P1n7EdBxF G/mg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=content-transfer-encoding:mime-version:list-unsubscribe :list-subscribe:list-id:precedence:message-id:date:subject:cc:to :from; bh=/1pscJPATbvt/3K/K7pqEchaH/11tBdJogfONHWeHXA=; fh=uzcLnoZjRYBfGFGaMgfGIqnh4SSyH/u85WoJrJeJq/g=; b=KbtsO+mUFH5aiYLFPAebL48Qz1tsU7QiJ0gQzM5nusyZeN7xqiqVDbYzXwFJNPd9Kb xOcasu0ve1DsS3MzqHAOhWL70PtjQbj4oMINUNSycayVmfAf4a5wHypzYlblJgJHiE+H cZGvo6lNBIxR/7bvVOZlQkzzoBIt/wL2vzVr976LBcEMA/IEA1ZaovNJL/OdexeJKA1n EpgCN59WpSGUBbfQAOOmiUxuhYhHydEp2JnXgMvSR3xqgUVtCzXk/psDD0e4LeuH35zx oFnqnczZ4aWWdqgPDaeGEepbXAbGWjb50vG+nNBJAuZnmjQ2t58aIxsvs+mgzwHNMQk0 z+dw== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel+bounces-11024-ouuuleilei=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) smtp.mailfrom="linux-kernel+bounces-11024-ouuuleilei=gmail.com@vger.kernel.org" Received: from sv.mirrors.kernel.org (sv.mirrors.kernel.org. [2604:1380:45e3:2400::1]) by mx.google.com with ESMTPS id q16-20020a170902edd000b001c3a06b4fd7si7554813plk.561.2023.12.25.03.47.47 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 25 Dec 2023 03:47:47 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel+bounces-11024-ouuuleilei=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) client-ip=2604:1380:45e3:2400::1; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel+bounces-11024-ouuuleilei=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) smtp.mailfrom="linux-kernel+bounces-11024-ouuuleilei=gmail.com@vger.kernel.org" Received: from smtp.subspace.kernel.org (wormhole.subspace.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sv.mirrors.kernel.org (Postfix) with ESMTPS id 1B5F0281158 for ; Mon, 25 Dec 2023 11:47:47 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 3A7D151C44; Mon, 25 Dec 2023 11:47:26 +0000 (UTC) X-Original-To: linux-kernel@vger.kernel.org Received: from zg8tmja2lje4os4yms4ymjma.icoremail.net (zg8tmja2lje4os4yms4ymjma.icoremail.net [206.189.21.223]) by smtp.subspace.kernel.org (Postfix) with ESMTP id D253051027; Mon, 25 Dec 2023 11:47:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=zju.edu.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=zju.edu.cn Received: from luzhipeng.223.5.5.5 (unknown [125.120.146.113]) by mail-app3 (Coremail) with SMTP id cC_KCgCnHHC0a4llSthxAQ--.18589S2; Mon, 25 Dec 2023 19:47:01 +0800 (CST) From: Zhipeng Lu To: alexious@zju.edu.cn Cc: Simon Horman , Edward Cree , Martin Habets , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , netdev@vger.kernel.org, linux-net-drivers@amd.com, linux-kernel@vger.kernel.org Subject: [PATCH net] [v2] sfc: fix a double-free bug in efx_probe_filters Date: Mon, 25 Dec 2023 19:29:14 +0800 Message-Id: <20231225112915.3544581-1-alexious@zju.edu.cn> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-CM-TRANSID: cC_KCgCnHHC0a4llSthxAQ--.18589S2 X-Coremail-Antispam: 1UD129KBjvJXoW7tFWDZF48ZrWfAFy8Kry8Xwb_yoW8GF4xpa yYk342gr1rXF15W3WkJ34kZF98AayDXa47WFnIkw4fuw1qyrn8Cw1Sqaya9ryDArW3Aa1a vwnYyr1UZ3ZxAFJanT9S1TB71UUUUUUqnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUkE14x267AKxVW8JVW5JwAFc2x0x2IEx4CE42xK8VAvwI8IcIk0 rVWrJVCq3wAFIxvE14AKwVWUJVWUGwA2ocxC64kIII0Yj41l84x0c7CEw4AK67xGY2AK02 1l84ACjcxK6xIIjxv20xvE14v26w1j6s0DM28EF7xvwVC0I7IYx2IY6xkF7I0E14v26F4U JVW0owA2z4x0Y4vEx4A2jsIE14v26rxl6s0DM28EF7xvwVC2z280aVCY1x0267AKxVW0oV Cq3wAS0I0E0xvYzxvE52x082IY62kv0487Mc02F40EFcxC0VAKzVAqx4xG6I80ewAv7VC0 I7IYx2IY67AKxVWUJVWUGwAv7VC2z280aVAFwI0_Jr0_Gr1lOx8S6xCaFVCjc4AY6r1j6r 4UM4x0Y48IcxkI7VAKI48JM4x0x7Aq67IIx4CEVc8vx2IErcIFxwACI402YVCY1x02628v n2kIc2xKxwCF04k20xvY0x0EwIxGrwCFx2IqxVCFs4IE7xkEbVWUJVW8JwC20s026c02F4 0E14v26r1j6r18MI8I3I0E7480Y4vE14v26r106r1rMI8E67AF67kF1VAFwI0_Jw0_GFyl IxkGc2Ij64vIr41lIxAIcVC0I7IYx2IY67AKxVWUJVWUCwCI42IY6xIIjxv20xvEc7CjxV AFwI0_Gr0_Cr1lIxAIcVCF04k26cxKx2IYs7xG6r1j6r1xMIIF0xvEx4A2jsIE14v26r1j 6r4UMIIF0xvEx4A2jsIEc7CjxVAFwI0_Gr0_Gr1UYxBIdaVFxhVjvjDU0xZFpf9x0JUdHU DUUUUU= X-CM-SenderInfo: qrsrjiarszq6lmxovvfxof0/ X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1785997848308558262 X-GMAIL-MSGID: 1786254319405155494 In efx_probe_filters, the channel->rps_flow_id is freed in a efx_for_each_channel marco when success equals to 0. However, after the following call chain: ef100_net_open |-> efx_probe_filters |-> ef100_net_stop |-> efx_remove_filters The channel->rps_flow_id is freed again in the efx_for_each_channel of efx_remove_filters, triggering a double-free bug. Fixes: a9dc3d5612ce ("sfc_ef100: RX filter table management and related gubbins") Reviewed-by: Simon Horman Reviewed-by: Edward Cree Signed-off-by: Zhipeng Lu --- Changelog: v2: Correct the call-chain description in commit message and change patch subject. --- drivers/net/ethernet/sfc/rx_common.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/sfc/rx_common.c b/drivers/net/ethernet/sfc/rx_common.c index d2f35ee15eff..fac227d372db 100644 --- a/drivers/net/ethernet/sfc/rx_common.c +++ b/drivers/net/ethernet/sfc/rx_common.c @@ -823,8 +823,10 @@ int efx_probe_filters(struct efx_nic *efx) } if (!success) { - efx_for_each_channel(channel, efx) + efx_for_each_channel(channel, efx) { kfree(channel->rps_flow_id); + channel->rps_flow_id = NULL; + } efx->type->filter_table_remove(efx); rc = -ENOMEM; goto out_unlock;