DPDK patches and discussions
 help / color / mirror / Atom feed
From: Michael Baum <michaelba@mellanox.com>
To: dev@dpdk.org
Cc: matan@mellanox.com, viacheslavo@mellanox.com, stable@dpdk.org
Subject: [dpdk-dev] [PATCH 2/6] net/mlx5: fix hairpin Rx queue creation error flow
Date: Wed, 27 May 2020 08:37:53 +0000	[thread overview]
Message-ID: <1590568677-11662-2-git-send-email-michaelba@mellanox.com> (raw)
In-Reply-To: <1590568677-11662-1-git-send-email-michaelba@mellanox.com>

The mlx5_rxq_obj_hairpin_new function defines a pointer named tmpl and
allocates memory for it using the rte_zmalloc_socket function.
Later, this function allocates memory to a variable inside tmpl using
the mlx5_devx_cmd_create_rq function.

In both cases, if the allocation fails, the code jumps to the error
label and frees allocated resources. However, in the first jump there
are still no resources to free and the jump only for the line return
NULL is unnecessary. Even worse, when it jumps to error label with
invalid tmpl it actually does dereference to a null pointer.
In contrast, the second jump needs to free the tmpl variable but the
function instead of freeing, tries to free the variable that it just
failed to allocate.
In addition, for another error, the function returns NULL without
freeing the tmpl variable before, causing a memory leak.

Delete the error label and replace each jump with local return NULL and
free tmpl variable if needed.

Fixes: e79c9be91515 ("net/mlx5: support Rx hairpin queues")
Cc: stable@dpdk.org

Signed-off-by: Michael Baum <michaelba@mellanox.com>
Acked-by: Matan Azrad <matan@mellanox.com>
 drivers/net/mlx5/mlx5_rxq.c | 13 ++++---------
 1 file changed, 4 insertions(+), 9 deletions(-)

diff --git a/drivers/net/mlx5/mlx5_rxq.c b/drivers/net/mlx5/mlx5_rxq.c
index 7a50ec6..0b0abe1 100644
--- a/drivers/net/mlx5/mlx5_rxq.c
+++ b/drivers/net/mlx5/mlx5_rxq.c
@@ -1267,7 +1267,6 @@
 		container_of(rxq_data, struct mlx5_rxq_ctrl, rxq);
 	struct mlx5_devx_create_rq_attr attr = { 0 };
 	struct mlx5_rxq_obj *tmpl = NULL;
-	int ret = 0;
 	uint32_t max_wq_data;
@@ -1279,7 +1278,7 @@
 			"port %u Rx queue %u cannot allocate verbs resources",
 			dev->data->port_id, rxq_data->idx);
 		rte_errno = ENOMEM;
-		goto error;
+		return NULL;
 	tmpl->rxq_ctrl = rxq_ctrl;
@@ -1291,6 +1290,7 @@
 			DRV_LOG(ERR, "total data size %u power of 2 is "
 				"too large for hairpin",
+			rte_free(tmpl);
 			rte_errno = ERANGE;
 			return NULL;
@@ -1310,8 +1310,9 @@
 			"port %u Rx hairpin queue %u can't create rq object",
 			dev->data->port_id, idx);
+		rte_free(tmpl);
 		rte_errno = errno;
-		goto error;
+		return NULL;
 	DRV_LOG(DEBUG, "port %u rxq %u updated with %p", dev->data->port_id,
 		idx, (void *)&tmpl);
@@ -1319,12 +1320,6 @@
 	LIST_INSERT_HEAD(&priv->rxqsobj, tmpl, next);
 	priv->verbs_alloc_ctx.type = MLX5_VERBS_ALLOC_TYPE_NONE;
 	return tmpl;
-	ret = rte_errno; /* Save rte_errno before cleanup. */
-	if (tmpl->rq)
-		mlx5_devx_cmd_destroy(tmpl->rq);
-	rte_errno = ret; /* Restore rte_errno. */
-	return NULL;

  reply	other threads:[~2020-05-27  8:39 UTC|newest]

Thread overview: 7+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-05-27  8:37 [dpdk-dev] [PATCH 1/6] net/mlx5: fix hairpin Tx " Michael Baum
2020-05-27  8:37 ` Michael Baum [this message]
2020-05-27  8:37 ` [dpdk-dev] [PATCH 3/6] net/mlx5: fix unnecessary init in socket handle Michael Baum
2020-05-27  8:37 ` [dpdk-dev] [PATCH 4/6] net/mlx5: fix socket handle closing Michael Baum
2020-05-27  8:37 ` [dpdk-dev] [PATCH 5/6] net/mlx5: fix needless txq initialization check Michael Baum
2020-05-27  8:37 ` [dpdk-dev] [PATCH 6/6] net/mlx5: fix compiler code arrangement in MPLS support Michael Baum
2020-05-31 11:26 ` [dpdk-dev] [PATCH 1/6] net/mlx5: fix hairpin Tx queue creation error flow Raslan Darawsheh

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1590568677-11662-2-git-send-email-michaelba@mellanox.com \
    --to=michaelba@mellanox.com \
    --cc=dev@dpdk.org \
    --cc=matan@mellanox.com \
    --cc=stable@dpdk.org \
    --cc=viacheslavo@mellanox.com \


* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).