Re: [PATCH net] net/mlx5e: TC, Fix double free of branch in failure

[Paolo Abeni]

On 10/28/26 15:57, Thomas Fourier wrote:
> When allocating the false branch fails in parse_branch_ctrl(), the
> already allocated true branch is freed but attr->branch_true is left
> pointing to it. The caller parse_tc_actions() fails the flow, and
> free_flow_post_acts(), mlx5_free_flow_attr_actions() which calls again
> free_branch_attr() on attr->branch_true.
>
> Clear the pointer after freeing it.
>
> This bug is theoretical and was compile tested only.
>
> Fixes: f86488cb4685 ("net/mlx5e: TC, initialize branch flow attributes")
> Signed-off-by: Thomas Fourier <fourier.thomas@xxxxxxxxx>
Given the lack of H/W testing I would appreciate an explicit ack
from the mlx crew.

Thanks,

Paolo