[PATCH net] mlxsw: core_linecards: Fix double memory deallocation in case of invalid INI file

[PATCH net] mlxsw: core_linecards: Fix double memory deallocation in case of invalid INI file

[Aleksandr Mishin]

In case of invalid INI file mlxsw_linecard_types_init() deallocates memory
but doesn't reset pointer to NULL and returns 0. In case of any error
occured after mlxsw_linecard_types_init() call, mlxsw_linecards_init()
calls mlxsw_linecard_types_fini() which perform memory deallocation again.

Add pointer reset to NULL.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: b217127e5e4e ("mlxsw: core_linecards: Add line card objects and implement provisioning")
Signed-off-by: Aleksandr Mishin <amishin@t-argos.ru>
---
 drivers/net/ethernet/mellanox/mlxsw/core_linecards.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/mellanox/mlxsw/core_linecards.c b/drivers/net/ethernet/mellanox/mlxsw/core_linecards.c
index 025e0db983fe..b032d5a4b3b8 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/core_linecards.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/core_linecards.c
@@ -1484,6 +1484,7 @@ static int mlxsw_linecard_types_init(struct mlxsw_core *mlxsw_core,
 	vfree(types_info->data);
 err_data_alloc:
 	kfree(types_info);
+	linecards->types_info = NULL;
 	return err;
 }
 
-- 
2.30.2

Re: [PATCH net] mlxsw: core_linecards: Fix double memory deallocation in case of invalid INI file

[Przemek Kitszel]

On 7/2/24 12:33, Aleksandr Mishin wrote:
> In case of invalid INI file mlxsw_linecard_types_init() deallocates memory

IMO there should be some comment in the code indicating that invalid
file is not a critical error. I find it weird anyway that you ignore
invalid-file-error, but propagate ENOMEM.

> but doesn't reset pointer to NULL and returns 0. In case of any error
> occured after mlxsw_linecard_types_init() call, mlxsw_linecards_init()

typo: occurred

> calls mlxsw_linecard_types_fini() which perform memory deallocation again.
> 
> Add pointer reset to NULL.
> 
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
> 
> Fixes: b217127e5e4e ("mlxsw: core_linecards: Add line card objects and implement provisioning")

this indeed avoids double free,
Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>

> Signed-off-by: Aleksandr Mishin <amishin@t-argos.ru>
> ---
>   drivers/net/ethernet/mellanox/mlxsw/core_linecards.c | 1 +
>   1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/net/ethernet/mellanox/mlxsw/core_linecards.c b/drivers/net/ethernet/mellanox/mlxsw/core_linecards.c
> index 025e0db983fe..b032d5a4b3b8 100644
> --- a/drivers/net/ethernet/mellanox/mlxsw/core_linecards.c
> +++ b/drivers/net/ethernet/mellanox/mlxsw/core_linecards.c
> @@ -1484,6 +1484,7 @@ static int mlxsw_linecard_types_init(struct mlxsw_core *mlxsw_core,
>   	vfree(types_info->data);
>   err_data_alloc:
>   	kfree(types_info);
> +	linecards->types_info = NULL;
>   	return err;
>   }
>   

BTW:
mlxsw_linecard_types_file_validate() don't need @types_info param

Re: [PATCH net] mlxsw: core_linecards: Fix double memory deallocation in case of invalid INI file

[Ido Schimmel]

On Tue, Jul 02, 2024 at 01:33:52PM +0300, Aleksandr Mishin wrote:
> In case of invalid INI file mlxsw_linecard_types_init() deallocates memory
> but doesn't reset pointer to NULL and returns 0. In case of any error
> occured after mlxsw_linecard_types_init() call, mlxsw_linecards_init()
> calls mlxsw_linecard_types_fini() which perform memory deallocation again.

s/perform/performs/

> 
> Add pointer reset to NULL.
> 
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
> 
> Fixes: b217127e5e4e ("mlxsw: core_linecards: Add line card objects and implement provisioning")
> Signed-off-by: Aleksandr Mishin <amishin@t-argos.ru>

Reviewed-by: Ido Schimmel <idosch@nvidia.com>