[dpdk-stable] [PATCH 2/3] net/bnx2x: fix invalid free on unplug

[dpdk-stable] [PATCH 2/3] net/bnx2x: fix invalid free on unplug

[David Marchand]

mac_addrs points to a field in dev_private.
We can't let ethdev free it.

Fixes: e16adf08e54d ("ethdev: free all common data when releasing port")
Cc: stable@dpdk.org

Signed-off-by: David Marchand <david.marchand@redhat.com>
---
 drivers/net/bnx2x/bnx2x_ethdev.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/net/bnx2x/bnx2x_ethdev.c b/drivers/net/bnx2x/bnx2x_ethdev.c
index 45c6c36..f47a73c 100644
--- a/drivers/net/bnx2x/bnx2x_ethdev.c
+++ b/drivers/net/bnx2x/bnx2x_ethdev.c
@@ -701,6 +701,13 @@ void bnx2x_periodic_stop(void *param)
 	return bnx2x_common_dev_init(eth_dev, 1);
 }
 
+static int eth_bnx2x_dev_uninit(struct rte_eth_dev *eth_dev)
+{
+	/* mac_addrs must not be freed alone because part of dev_private */
+	eth_dev->data->mac_addrs = NULL;
+	return 0;
+}
+
 static struct rte_pci_driver rte_bnx2x_pmd;
 static struct rte_pci_driver rte_bnx2xvf_pmd;
 
@@ -719,7 +726,7 @@ static int eth_bnx2x_pci_probe(struct rte_pci_driver *pci_drv,
 
 static int eth_bnx2x_pci_remove(struct rte_pci_device *pci_dev)
 {
-	return rte_eth_dev_pci_generic_remove(pci_dev, NULL);
+	return rte_eth_dev_pci_generic_remove(pci_dev, eth_bnx2x_dev_uninit);
 }
 
 static struct rte_pci_driver rte_bnx2x_pmd = {
-- 
1.8.3.1

[dpdk-stable] [PATCH 3/3] drivers/net: fix double free on init failure cleanup

[David Marchand]

If we don't clear mac_addrs, ethdev will double free it on cleanup.

Fixes: e16adf08e54d ("ethdev: free all common data when releasing port")
Cc: stable@dpdk.org

Signed-off-by: David Marchand <david.marchand@redhat.com>
---
 drivers/net/ark/ark_ethdev.c        | 6 +++---
 drivers/net/axgbe/axgbe_ethdev.c    | 1 +
 drivers/net/i40e/i40e_ethdev.c      | 1 +
 drivers/net/ice/ice_ethdev.c        | 1 +
 drivers/net/thunderx/nicvf_ethdev.c | 1 +
 5 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ark/ark_ethdev.c b/drivers/net/ark/ark_ethdev.c
index 7fd784c..86e500e 100644
--- a/drivers/net/ark/ark_ethdev.c
+++ b/drivers/net/ark/ark_ethdev.c
@@ -403,9 +403,9 @@ static void eth_ark_macaddr_remove(struct rte_eth_dev *dev,
 
 	return ret;
 
- error:
-	if (dev->data->mac_addrs)
-		rte_free(dev->data->mac_addrs);
+error:
+	rte_free(dev->data->mac_addrs);
+	dev->data->mac_addrs = NULL;
 	return -1;
 }
 
diff --git a/drivers/net/axgbe/axgbe_ethdev.c b/drivers/net/axgbe/axgbe_ethdev.c
index 6b3bc3e..cfb1720 100644
--- a/drivers/net/axgbe/axgbe_ethdev.c
+++ b/drivers/net/axgbe/axgbe_ethdev.c
@@ -700,6 +700,7 @@ static void axgbe_default_config(struct axgbe_port *pdata)
 	ret = pdata->phy_if.phy_init(pdata);
 	if (ret) {
 		rte_free(eth_dev->data->mac_addrs);
+		eth_dev->data->mac_addrs = NULL;
 		return ret;
 	}
 
diff --git a/drivers/net/i40e/i40e_ethdev.c b/drivers/net/i40e/i40e_ethdev.c
index 3cf2c1b..69a9cff 100644
--- a/drivers/net/i40e/i40e_ethdev.c
+++ b/drivers/net/i40e/i40e_ethdev.c
@@ -1600,6 +1600,7 @@ static inline void i40e_config_automask(struct i40e_pf *pf)
 	rte_free(pf->ethertype.hash_map);
 err_init_ethtype_filter_list:
 	rte_free(dev->data->mac_addrs);
+	dev->data->mac_addrs = NULL;
 err_mac_alloc:
 	i40e_vsi_release(pf->main_vsi);
 err_setup_pf_switch:
diff --git a/drivers/net/ice/ice_ethdev.c b/drivers/net/ice/ice_ethdev.c
index bdbceb4..a7de455 100644
--- a/drivers/net/ice/ice_ethdev.c
+++ b/drivers/net/ice/ice_ethdev.c
@@ -1466,6 +1466,7 @@ static int ice_load_pkg(struct rte_eth_dev *dev)
 	ice_res_pool_destroy(&pf->msix_pool);
 err_msix_pool_init:
 	rte_free(dev->data->mac_addrs);
+	dev->data->mac_addrs = NULL;
 err_init_mac:
 	ice_sched_cleanup_all(hw);
 	rte_free(hw->port_info);
diff --git a/drivers/net/thunderx/nicvf_ethdev.c b/drivers/net/thunderx/nicvf_ethdev.c
index eb2c11d..ec57692 100644
--- a/drivers/net/thunderx/nicvf_ethdev.c
+++ b/drivers/net/thunderx/nicvf_ethdev.c
@@ -2206,6 +2206,7 @@ static void nicvf_vf_stop(struct rte_eth_dev *dev, struct nicvf *nic,
 
 malloc_fail:
 	rte_free(eth_dev->data->mac_addrs);
+	eth_dev->data->mac_addrs = NULL;
 alarm_fail:
 	nicvf_periodic_alarm_stop(nicvf_interrupt, eth_dev);
 fail:
-- 
1.8.3.1

Re: [dpdk-stable] [PATCH 2/3] net/bnx2x: fix invalid free on unplug

[Ferruh Yigit]

On 6/17/2019 4:05 PM, David Marchand wrote:
> mac_addrs points to a field in dev_private.
> We can't let ethdev free it.
> 
> Fixes: e16adf08e54d ("ethdev: free all common data when releasing port")
> Cc: stable@dpdk.org
> 
> Signed-off-by: David Marchand <david.marchand@redhat.com>

Reviewed-by: Ferruh Yigit <ferruh.yigit@intel.com>

Applied to dpdk-next-net/master, thanks.

Re: [dpdk-stable] [PATCH 3/3] drivers/net: fix double free on init failure cleanup

[Ferruh Yigit]

On 6/17/2019 4:05 PM, David Marchand wrote:
> If we don't clear mac_addrs, ethdev will double free it on cleanup.
> 
> Fixes: e16adf08e54d ("ethdev: free all common data when releasing port")
> Cc: stable@dpdk.org
> 
> Signed-off-by: David Marchand <david.marchand@redhat.com>

Reviewed-by: Ferruh Yigit <ferruh.yigit@intel.com>

Applied to dpdk-next-net/master, thanks.