DPDK patches and discussions
 help / color / mirror / Atom feed
* [PATCH] net/bnxt: fix free of not allocated object
@ 2025-05-21 19:37 Stephen Hemminger
  0 siblings, 0 replies; only message in thread
From: Stephen Hemminger @ 2025-05-21 19:37 UTC (permalink / raw)
  To: dev
  Cc: Stephen Hemminger, Ajit Khaparde, Somnath Kotur,
	Peter Spreadborough, Farah Smith, Jay Ding, Shahaji Bhosle

This was found as error when compiling with LTO.
The function allocates new data with rte_zmalloc and then
stores pointer in the pointer-to-pointer passed as argument.
In the unwind case, it would call rte_free() with wrong one.

Fixes: 80317ff6adfd ("net/bnxt/tf_core: support Thor2")

Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
---
 drivers/net/bnxt/tf_core/v3/tfo.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/drivers/net/bnxt/tf_core/v3/tfo.c b/drivers/net/bnxt/tf_core/v3/tfo.c
index bee813ebf6..c888dd1e4e 100644
--- a/drivers/net/bnxt/tf_core/v3/tfo.c
+++ b/drivers/net/bnxt/tf_core/v3/tfo.c
@@ -74,9 +74,7 @@ void tfo_open(void **tfo, bool is_pf)
 	rc = cfa_bld_mpc_bind(CFA_P70, &tfco->mpc_info);
 	if (rc) {
 		PMD_DRV_LOG_LINE(ERR, "MPC bind failed");
-		rte_free(tfco);
-		*tfo = NULL;
-		return;
+		goto cleanup;
 	}
 	if (is_pf) {
 		/* Allocate TIM */
@@ -104,8 +102,8 @@ void tfo_open(void **tfo, bool is_pf)
 	return;
 
  cleanup:
-	if (tfco != NULL)
-		rte_free(tfo);
+	rte_free(tfco);
+	*tfo = NULL;
 }
 
 void tfo_close(void **tfo)
-- 
2.47.2


^ permalink raw reply	[flat|nested] only message in thread

only message in thread, other threads:[~2025-05-21 19:37 UTC | newest]

Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2025-05-21 19:37 [PATCH] net/bnxt: fix free of not allocated object Stephen Hemminger

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).