net/mlx5e: fix bpf_prog reference count leaks in mlx5e_alloc_rq
authorXin Xiong <xiongx18@fudan.edu.cn>
Thu, 30 Jul 2020 10:29:41 +0000 (18:29 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 5 Aug 2020 07:58:47 +0000 (09:58 +0200)
commit017193553c93c284466d9e7ebe60e8b61e6a4c10
treee80008b885dbec2521bf498461800e891c73a61a
parenta04c4b395192523d8f3bd9f9baae56e491e80f09
net/mlx5e: fix bpf_prog reference count leaks in mlx5e_alloc_rq

[ Upstream commit e692139e6af339a1495ef401b2d95f7f9d1c7a44 ]

The function invokes bpf_prog_inc(), which increases the reference
count of a bpf_prog object "rq->xdp_prog" if the object isn't NULL.

The refcount leak issues take place in two error handling paths. When
either mlx5_wq_ll_create() or mlx5_wq_cyc_create() fails, the function
simply returns the error code and forgets to drop the reference count
increased earlier, causing a reference count leak of "rq->xdp_prog".

Fix this issue by jumping to the error handling path err_rq_wq_destroy
while either function fails.

Fixes: 422d4c401edd ("net/mlx5e: RX, Split WQ objects for different RQ types")
Signed-off-by: Xin Xiong <xiongx18@fudan.edu.cn>
Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/net/ethernet/mellanox/mlx5/core/en_main.c