Re: [PATCH net] net/mlx5e: TC, Fix double free of branch in failure

[Tariq Toukan <tariqt@nvidia.com>]

On 05/11/2026 11:18, Paolo Abeni wrote:
> On 10/28/26 15:57, Thomas Fourier wrote:
>> When allocating the false branch fails in parse_branch_ctrl(), the
>> already allocated true branch is freed but attr->branch_true is left
>> pointing to it. The caller parse_tc_actions() fails the flow, and
>> free_flow_post_acts(), mlx5_free_flow_attr_actions() which calls again
>> free_branch_attr() on attr->branch_true.
>>
>> Clear the pointer after freeing it.
>>
>> This bug is theoretical and was compile tested only.
>>

I reproduced it on ConnectX-6 Dx in switchdev mode, with KASAN:

     tc filter add dev $UPLINK ingress protocol ip flower skip_sw \
             dst_ip 192.0.2.2 action police rate 1mbit burst 20k \
             conform-exceed jump 1 / jump 1 action pass action drop

Every attempt reports a double-free in mlx5_free_flow_attr_actions().
With this patch, 50 attempts reported none.

>> Fixes: f86488cb4685 ("net/mlx5e: TC, initialize branch flow attributes")
>> Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
> Given the lack of H/W testing I would appreciate an explicit ack
> from the mlx crew.
> 
> Thanks,
> 
> Paolo

Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
Tested-by: Tariq Toukan <tariqt@nvidia.com>

The same command also leaks the parse_attr of the false branch, as 
alloc_branch_attr() frees only the attr on its error path. I'll send a 
separate fix for that.

Thanks,
Tariq