Re: [PATCH net] net/mlx5e: TC, Fix double free of branch in failure

[Tariq Toukan]

On 05/11/2026 11:18, Paolo Abeni wrote:
> On 10/28/26 15:57, Thomas Fourier wrote:
> > When allocating the false branch fails in parse_branch_ctrl(), the
> > already allocated true branch is freed but attr->branch_true is left
> > pointing to it. The caller parse_tc_actions() fails the flow, and
> > free_flow_post_acts(), mlx5_free_flow_attr_actions() which calls again
> > free_branch_attr() on attr->branch_true.
> >
> > Clear the pointer after freeing it.
> >
> > This bug is theoretical and was compile tested only.

I reproduced it on ConnectX-6 Dx in switchdev mode, with KASAN:

    tc filter add dev $UPLINK ingress protocol ip flower skip_sw \
            dst_ip 192.0.2.2 action police rate 1mbit burst 20k \
            conform-exceed jump 1 / jump 1 action pass action drop

Every attempt reports a double-free in mlx5_free_flow_attr_actions().
With this patch, 50 attempts reported none.

> > Fixes: f86488cb4685 ("net/mlx5e: TC, initialize branch flow attributes")
> > Signed-off-by: Thomas Fourier <fourier.thomas@xxxxxxxxx>
> Given the lack of H/W testing I would appreciate an explicit ack
> from the mlx crew.
>
> Thanks,
>
> Paolo

Reviewed-by: Tariq Toukan <tariqt@xxxxxxxxxx>
Tested-by: Tariq Toukan <tariqt@xxxxxxxxxx>

The same command also leaks the parse_attr of the false branch, as 
alloc_branch_attr() frees only the attr on its error path. I'll send a 
separate fix for that.

Thanks,
Tariq