diff mbox series

[net] net/mlx5: Don't use already freed action pointer

Message ID 7fe70bbb120422cc71e6b018531954d58ea2e61e.1653397057.git.leonro@nvidia.com (mailing list archive)
State Not Applicable
Headers show
Series [net] net/mlx5: Don't use already freed action pointer | expand

Commit Message

Leon Romanovsky May 24, 2022, 12:59 p.m. UTC 
From: Leon Romanovsky <leonro@nvidia.com>

The call to mlx5dr_action_destroy() releases "action" memory. That
pointer is set to miss_action later and generates the following smatch
error:

 drivers/net/ethernet/mellanox/mlx5/core/steering/fs_dr.c:53 set_miss_action()
 warn: 'action' was already freed.

Make sure that the pointer is always valid by setting NULL after destroy.

Fixes: 6a48faeeca10 ("net/mlx5: Add direct rule fs_cmd implementation")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
---
 drivers/net/ethernet/mellanox/mlx5/core/steering/fs_dr.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

Comments

Saeed Mahameed May 28, 2022, 5:28 a.m. UTC | #1 
On 24 May 15:59, Leon Romanovsky wrote:
>From: Leon Romanovsky <leonro@nvidia.com>
>
>The call to mlx5dr_action_destroy() releases "action" memory. That
>pointer is set to miss_action later and generates the following smatch
>error:
>
> drivers/net/ethernet/mellanox/mlx5/core/steering/fs_dr.c:53 set_miss_action()
> warn: 'action' was already freed.
>
>Make sure that the pointer is always valid by setting NULL after destroy.
>
>Fixes: 6a48faeeca10 ("net/mlx5: Add direct rule fs_cmd implementation")
>Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
>Signed-off-by: Leon Romanovsky <leonro@nvidia.com>

Applied to net-mlx5. I am still working on other critical fixes in my
net queue, will submit all at once next week so we can make it to rc1.

Thanks,
Saeed
diff mbox series

Patch

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/fs_dr.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/fs_dr.c
index 728f81882589..6a9abba92df6 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/fs_dr.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/fs_dr.c
@@ -44,11 +44,10 @@  static int set_miss_action(struct mlx5_flow_root_namespace *ns,
 	err = mlx5dr_table_set_miss_action(ft->fs_dr_table.dr_table, action);
 	if (err && action) {
 		err = mlx5dr_action_destroy(action);
-		if (err) {
-			action = NULL;
-			mlx5_core_err(ns->dev, "Failed to destroy action (%d)\n",
-				      err);
-		}
+		if (err)
+			mlx5_core_err(ns->dev,
+				      "Failed to destroy action (%d)\n", err);
+		action = NULL;
 	}
 	ft->fs_dr_table.miss_action = action;
 	if (old_miss_action) {