[PATCH] net/bnxt: fix free of not allocated object

[PATCH] net/bnxt: fix free of not allocated object

[Stephen Hemminger]

This was found as error when compiling with LTO.
The function allocates new data with rte_zmalloc and then
stores pointer in the pointer-to-pointer passed as argument.
In the unwind case, it would call rte_free() with wrong one.

Fixes: 80317ff6adfd ("net/bnxt/tf_core: support Thor2")

Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
---
 drivers/net/bnxt/tf_core/v3/tfo.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/drivers/net/bnxt/tf_core/v3/tfo.c b/drivers/net/bnxt/tf_core/v3/tfo.c
index bee813ebf6..c888dd1e4e 100644
--- a/drivers/net/bnxt/tf_core/v3/tfo.c
+++ b/drivers/net/bnxt/tf_core/v3/tfo.c
@@ -74,9 +74,7 @@ void tfo_open(void **tfo, bool is_pf)
 	rc = cfa_bld_mpc_bind(CFA_P70, &tfco->mpc_info);
 	if (rc) {
 		PMD_DRV_LOG_LINE(ERR, "MPC bind failed");
-		rte_free(tfco);
-		*tfo = NULL;
-		return;
+		goto cleanup;
 	}
 	if (is_pf) {
 		/* Allocate TIM */
@@ -104,8 +102,8 @@ void tfo_open(void **tfo, bool is_pf)
 	return;
 
  cleanup:
-	if (tfco != NULL)
-		rte_free(tfo);
+	rte_free(tfco);
+	*tfo = NULL;
 }
 
 void tfo_close(void **tfo)
-- 
2.47.2

Re: [PATCH] net/bnxt: fix free of not allocated object

[Stephen Hemminger]

On Wed, 21 May 2025 12:37:27 -0700
Stephen Hemminger <stephen@networkplumber.org> wrote:

> This was found as error when compiling with LTO.
> The function allocates new data with rte_zmalloc and then
> stores pointer in the pointer-to-pointer passed as argument.
> In the unwind case, it would call rte_free() with wrong one.
> 
> Fixes: 80317ff6adfd ("net/bnxt/tf_core: support Thor2")
> 
> Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
> ---
>  drivers/net/bnxt/tf_core/v3/tfo.c | 8 +++-----
>  1 file changed, 3 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/net/bnxt/tf_core/v3/tfo.c b/drivers/net/bnxt/tf_core/v3/tfo.c
> index bee813ebf6..c888dd1e4e 100644
> --- a/drivers/net/bnxt/tf_core/v3/tfo.c
> +++ b/drivers/net/bnxt/tf_core/v3/tfo.c
> @@ -74,9 +74,7 @@ void tfo_open(void **tfo, bool is_pf)
>  	rc = cfa_bld_mpc_bind(CFA_P70, &tfco->mpc_info);
>  	if (rc) {
>  		PMD_DRV_LOG_LINE(ERR, "MPC bind failed");
> -		rte_free(tfco);
> -		*tfo = NULL;
> -		return;
> +		goto cleanup;
>  	}
>  	if (is_pf) {
>  		/* Allocate TIM */
> @@ -104,8 +102,8 @@ void tfo_open(void **tfo, bool is_pf)
>  	return;
>  
>   cleanup:
> -	if (tfco != NULL)
> -		rte_free(tfo);
> +	rte_free(tfco);
> +	*tfo = NULL;
>  }
>  
>  void tfo_close(void **tfo)

Ping. This is a bug fix which seems to have gotten no response.