| Message ID | 20240702103352.15315-1-amishin@t-argos.ru (mailing list archive) |
|---|---|
| State | Superseded |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net] mlxsw: core_linecards: Fix double memory deallocation in case of invalid INI file | expand |
On 7/2/24 12:33, Aleksandr Mishin wrote: > In case of invalid INI file mlxsw_linecard_types_init() deallocates memory IMO there should be some comment in the code indicating that invalid file is not a critical error. I find it weird anyway that you ignore invalid-file-error, but propagate ENOMEM. > but doesn't reset pointer to NULL and returns 0. In case of any error > occured after mlxsw_linecard_types_init() call, mlxsw_linecards_init() typo: occurred > calls mlxsw_linecard_types_fini() which perform memory deallocation again. > > Add pointer reset to NULL. > > Found by Linux Verification Center (linuxtesting.org) with SVACE. > > Fixes: b217127e5e4e ("mlxsw: core_linecards: Add line card objects and implement provisioning") this indeed avoids double free, Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com> > Signed-off-by: Aleksandr Mishin <amishin@t-argos.ru> > --- > drivers/net/ethernet/mellanox/mlxsw/core_linecards.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/drivers/net/ethernet/mellanox/mlxsw/core_linecards.c b/drivers/net/ethernet/mellanox/mlxsw/core_linecards.c > index 025e0db983fe..b032d5a4b3b8 100644 > --- a/drivers/net/ethernet/mellanox/mlxsw/core_linecards.c > +++ b/drivers/net/ethernet/mellanox/mlxsw/core_linecards.c > @@ -1484,6 +1484,7 @@ static int mlxsw_linecard_types_init(struct mlxsw_core *mlxsw_core, > vfree(types_info->data); > err_data_alloc: > kfree(types_info); > + linecards->types_info = NULL; > return err; > } > BTW: mlxsw_linecard_types_file_validate() don't need @types_info param
On Tue, Jul 02, 2024 at 01:33:52PM +0300, Aleksandr Mishin wrote: > In case of invalid INI file mlxsw_linecard_types_init() deallocates memory > but doesn't reset pointer to NULL and returns 0. In case of any error > occured after mlxsw_linecard_types_init() call, mlxsw_linecards_init() > calls mlxsw_linecard_types_fini() which perform memory deallocation again. s/perform/performs/ > > Add pointer reset to NULL. > > Found by Linux Verification Center (linuxtesting.org) with SVACE. > > Fixes: b217127e5e4e ("mlxsw: core_linecards: Add line card objects and implement provisioning") > Signed-off-by: Aleksandr Mishin <amishin@t-argos.ru> Reviewed-by: Ido Schimmel <idosch@nvidia.com>
diff --git a/drivers/net/ethernet/mellanox/mlxsw/core_linecards.c b/drivers/net/ethernet/mellanox/mlxsw/core_linecards.c index 025e0db983fe..b032d5a4b3b8 100644 --- a/drivers/net/ethernet/mellanox/mlxsw/core_linecards.c +++ b/drivers/net/ethernet/mellanox/mlxsw/core_linecards.c @@ -1484,6 +1484,7 @@ static int mlxsw_linecard_types_init(struct mlxsw_core *mlxsw_core, vfree(types_info->data); err_data_alloc: kfree(types_info); + linecards->types_info = NULL; return err; }
In case of invalid INI file mlxsw_linecard_types_init() deallocates memory but doesn't reset pointer to NULL and returns 0. In case of any error occured after mlxsw_linecard_types_init() call, mlxsw_linecards_init() calls mlxsw_linecard_types_fini() which perform memory deallocation again. Add pointer reset to NULL. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: b217127e5e4e ("mlxsw: core_linecards: Add line card objects and implement provisioning") Signed-off-by: Aleksandr Mishin <amishin@t-argos.ru> --- drivers/net/ethernet/mellanox/mlxsw/core_linecards.c | 1 + 1 file changed, 1 insertion(+)