From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 26437A0546; Wed, 7 Apr 2021 05:04:11 +0200 (CEST) Received: from [217.70.189.124] (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 9E0BB14100C; Wed, 7 Apr 2021 05:04:10 +0200 (CEST) Received: from mail-qk1-f174.google.com (mail-qk1-f174.google.com [209.85.222.174]) by mails.dpdk.org (Postfix) with ESMTP id 01D24407FF for ; Wed, 7 Apr 2021 05:04:08 +0200 (CEST) Received: by mail-qk1-f174.google.com with SMTP id x11so17280361qkp.11 for ; Tue, 06 Apr 2021 20:04:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=broadcom.com; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=vZegFOms0HWqmvR2iBHgACD5AESYxgtOjpfPDNx1wJQ=; b=hrydPLMyc0FSjMVAA+oxj6FPAJSDRLzM6b4Mi/RfI9ir+SW6FBmBS/wmB5bZCrXu/t l1y4Qp4WomcZ/dc4NRWzDZs9/zhmJYuWPKP88EfzbAj7LWTccpoTHXN/xfHHitl9UFEr tJU81R1GOGytRq5BOp3d48lgGSNpMDu6hq7+w= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=vZegFOms0HWqmvR2iBHgACD5AESYxgtOjpfPDNx1wJQ=; b=di87Me/0bCCrwRdHrWeMFhPR17zUdhiyPzRlr3rZqlyfvw/9jeIflvlqajerceWjBZ tkCmdKzQgb5yMhim59lnVfvEPn2qSfQfgPldK+rqwamE+JB+Ifl0T/NCitKDBQ38N2JK sCsW23Gp0vk60kvZa3L9n9HyDxHvOSlzPsRruXXFqudYy2Cn59TasuW2bi/6pPW17awX /oqR6pfOY1OFWvYHokKyo7/aV3M0Sw+6ipyTaetaMBjui/7Tjdfj9wNfkyAlqso7PfIR hxr3bEtT94kJdHu+mS+9xkf3lphkgjk0gpvhTdTyWfUXpesHSOPI9d91cJtQuBAEZ3D0 oWqQ== X-Gm-Message-State: AOAM531a/zCakIHX7NmKCHdN9l21b006oLA2Y7Ut3JDZHri71ZjqyAfQ fn0E/MwhkX8Y7Xe+lopVxwIsizIJFNBcFz1uXb0yIA== X-Google-Smtp-Source: ABdhPJyvFzet2fMkfjT4Ne5+6AE8Ljl88/DwC1H6Vlk3HdudOLqw7PgYHPWuAces6r3DwS7dBFMpmJsm/GTPZ3FlVws= X-Received: by 2002:a37:43cc:: with SMTP id q195mr1097515qka.455.1617764648225; Tue, 06 Apr 2021 20:04:08 -0700 (PDT) MIME-Version: 1.0 References: <20210401025334.1706-1-kalesh-anakkur.purayil@broadcom.com> In-Reply-To: <20210401025334.1706-1-kalesh-anakkur.purayil@broadcom.com> From: Ajit Khaparde Date: Tue, 6 Apr 2021 20:03:51 -0700 Message-ID: To: Kalesh A P Cc: dpdk-dev , Ferruh Yigit Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="000000000000356cbe05bf592fcc" X-Content-Filtered-By: Mailman/MimeDel 2.1.29 Subject: Re: [dpdk-dev] [PATCH] net/bnxt: fix double free in port start failure X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" --000000000000356cbe05bf592fcc Content-Type: text/plain; charset="UTF-8" On Wed, Mar 31, 2021 at 7:31 PM Kalesh A P < kalesh-anakkur.purayil@broadcom.com> wrote: > From: Kalesh AP > > During port start when bnxt_start_nic() fails, it tries to free > "intr_handle->intr_vec" but the variable is not set to NULL after that. > If port start fails, driver invokes bnxt_dev_stop() which will lead > to a double free of "intr_handle->intr_vec". > > Fix it by removing the call to free "intr_handle->intr_vec" in the > bnxt_start_nic() failure path as it is anyway doing in bnxt_dev_stop(). > > Fixes: 9d276b439aaf ("net/bnxt: fix error handling in device start") > Cc: stable@dpdk.org > > Signed-off-by: Kalesh AP > Reviewed-by: Somnath Kotur > Reviewed-by: Ajit Kumar Khaparde > Patch applied to dpdk-next-net-brcm. > --- > drivers/net/bnxt/bnxt_ethdev.c | 10 +++------- > 1 file changed, 3 insertions(+), 7 deletions(-) > > diff --git a/drivers/net/bnxt/bnxt_ethdev.c > b/drivers/net/bnxt/bnxt_ethdev.c > index ed2ae45..0042d8a 100644 > --- a/drivers/net/bnxt/bnxt_ethdev.c > +++ b/drivers/net/bnxt/bnxt_ethdev.c > @@ -793,7 +793,7 @@ static int bnxt_start_nic(struct bnxt *bp) > PMD_DRV_LOG(ERR, "Failed to allocate %d rx_queues" > " intr_vec", > bp->eth_dev->data->nb_rx_queues); > rc = -ENOMEM; > - goto err_disable; > + goto err_out; > } > PMD_DRV_LOG(DEBUG, "intr_handle->intr_vec = %p " > "intr_handle->nb_efd = %d intr_handle->max_intr = > %d\n", > @@ -813,12 +813,12 @@ static int bnxt_start_nic(struct bnxt *bp) > #ifndef RTE_EXEC_ENV_FREEBSD > /* In FreeBSD OS, nic_uio driver does not support interrupts */ > if (rc) > - goto err_free; > + goto err_out; > #endif > > rc = bnxt_update_phy_setting(bp); > if (rc) > - goto err_free; > + goto err_out; > > bp->mark_table = rte_zmalloc("bnxt_mark_table", > BNXT_MARK_TABLE_SZ, 0); > if (!bp->mark_table) > @@ -826,10 +826,6 @@ static int bnxt_start_nic(struct bnxt *bp) > > return 0; > > -err_free: > - rte_free(intr_handle->intr_vec); > -err_disable: > - rte_intr_efd_disable(intr_handle); > err_out: > /* Some of the error status returned by FW may not be from errno.h > */ > if (rc > 0) > -- > 2.10.1 > > --000000000000356cbe05bf592fcc--