Commit b9a4c74b authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

Merge branch 'net-mlx5-fix-null-dereference-and-memory-leak-in-ttc_table-creation' 

Henry Martin says:

====================
net/mlx5: Fix NULL dereference and memory leak in ttc_table creation

This patch series addresses two issues in the
mlx5_create_inner_ttc_table() and mlx5_create_ttc_table() functions:

1. A potential NULL pointer dereference if mlx5_get_flow_namespace()
returns NULL.

2. A memory leak in the error path when ttc_type is invalid (default:
switch case).
====================

Link: https://patch.msgid.link/20250418023814.71789-1-bsdhenrymartin@gmail.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents 750d0ac0 fa8fd315

drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.c

+18 −8
Original line number Diff line number Diff line
@@ -637,10 +637,6 @@ struct mlx5_ttc_table *mlx5_create_inner_ttc_table(struct mlx5_core_dev *dev, 
	bool use_l4_type;

	int err;



	ttc = kvzalloc(sizeof(*ttc), GFP_KERNEL);

	if (!ttc)

		return ERR_PTR(-ENOMEM);



	switch (params->ns_type) {

	case MLX5_FLOW_NAMESPACE_PORT_SEL:

		use_l4_type = MLX5_CAP_GEN_2(dev, pcc_ifa2) &&
@@ -654,7 +650,16 @@ struct mlx5_ttc_table *mlx5_create_inner_ttc_table(struct mlx5_core_dev *dev, 
		return ERR_PTR(-EINVAL);

	}



	ttc = kvzalloc(sizeof(*ttc), GFP_KERNEL);

	if (!ttc)

		return ERR_PTR(-ENOMEM);



	ns = mlx5_get_flow_namespace(dev, params->ns_type);

	if (!ns) {

		kvfree(ttc);

		return ERR_PTR(-EOPNOTSUPP);

	}



	groups = use_l4_type ? &inner_ttc_groups[TTC_GROUPS_USE_L4_TYPE] :

			       &inner_ttc_groups[TTC_GROUPS_DEFAULT];
@@ -710,10 +715,6 @@ struct mlx5_ttc_table *mlx5_create_ttc_table(struct mlx5_core_dev *dev, 
	bool use_l4_type;

	int err;



	ttc = kvzalloc(sizeof(*ttc), GFP_KERNEL);

	if (!ttc)

		return ERR_PTR(-ENOMEM);



	switch (params->ns_type) {

	case MLX5_FLOW_NAMESPACE_PORT_SEL:

		use_l4_type = MLX5_CAP_GEN_2(dev, pcc_ifa2) &&
@@ -727,7 +728,16 @@ struct mlx5_ttc_table *mlx5_create_ttc_table(struct mlx5_core_dev *dev, 
		return ERR_PTR(-EINVAL);

	}



	ttc = kvzalloc(sizeof(*ttc), GFP_KERNEL);

	if (!ttc)

		return ERR_PTR(-ENOMEM);



	ns = mlx5_get_flow_namespace(dev, params->ns_type);

	if (!ns) {

		kvfree(ttc);

		return ERR_PTR(-EOPNOTSUPP);

	}



	groups = use_l4_type ? &ttc_groups[TTC_GROUPS_USE_L4_TYPE] :

			       &ttc_groups[TTC_GROUPS_DEFAULT];