From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from dpdk.org (dpdk.org [92.243.14.124]) by inbox.dpdk.org (Postfix) with ESMTP id DE8B4A04AE for ; Sun, 16 Aug 2020 14:07:12 +0200 (CEST) Received: from [92.243.14.124] (localhost [127.0.0.1]) by dpdk.org (Postfix) with ESMTP id CAFAA1C0DB; Sun, 16 Aug 2020 14:07:12 +0200 (CEST) Received: from mellanox.co.il (mail-il-dmz.mellanox.com [193.47.165.129]) by dpdk.org (Postfix) with ESMTP id 997921C0DB for ; Sun, 16 Aug 2020 14:07:11 +0200 (CEST) Received: from Internal Mail-Server by MTLPINE1 (envelope-from michaelba@mellanox.com) with SMTP; 16 Aug 2020 15:07:09 +0300 Received: from pegasus07.mtr.labs.mlnx (pegasus07.mtr.labs.mlnx [10.210.16.112]) by labmailer.mlnx (8.13.8/8.13.8) with ESMTP id 07GC79D5008786; Sun, 16 Aug 2020 15:07:09 +0300 Received: from pegasus07.mtr.labs.mlnx (localhost [127.0.0.1]) by pegasus07.mtr.labs.mlnx (8.14.7/8.14.7) with ESMTP id 07GC79Ao008098; Sun, 16 Aug 2020 12:07:09 GMT Received: (from michaelba@localhost) by pegasus07.mtr.labs.mlnx (8.14.7/8.14.7/Submit) id 07GC79p8008097; Sun, 16 Aug 2020 12:07:09 GMT From: Michael Baum To: stable@dpdk.org Cc: Matan Azrad , Raslan Darawsheh , Viacheslav Ovsiienko , Michael Baum Date: Sun, 16 Aug 2020 12:06:55 +0000 Message-Id: <1597579615-8044-2-git-send-email-michaelba@mellanox.com> X-Mailer: git-send-email 1.8.3.1 In-Reply-To: <1597579615-8044-1-git-send-email-michaelba@mellanox.com> References: <1597579615-8044-1-git-send-email-michaelba@mellanox.com> Subject: [dpdk-stable] [PATCH 19.11 2/2] net/mlx5: fix hairpin Rx queue creation error flow X-BeenThere: stable@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: patches for DPDK stable branches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: stable-bounces@dpdk.org Sender: "stable" [ upstream commit ebed623f621bbe9cf050a9eb7725f4d81cb95d4f ] The mlx5_rxq_obj_hairpin_new function defines a pointer named tmpl and allocates memory for it using the rte_zmalloc_socket function. Later, this function allocates memory to a variable inside tmpl using the mlx5_devx_cmd_create_rq function. In both cases, if the allocation fails, the code jumps to the error label and frees allocated resources. However, in the first jump there are still no resources to free and the jump only for the line return NULL is unnecessary. Even worse, when it jumps to error label with invalid tmpl it actually does dereference to a null pointer. In contrast, the second jump needs to free the tmpl variable but the function instead of freeing, tries to free the variable that it just failed to allocate. In addition, for another error, the function returns NULL without freeing the tmpl variable before, causing a memory leak. Delete the error label and replace each jump with local return NULL and free tmpl variable if needed. Fixes: e79c9be91515 ("net/mlx5: support Rx hairpin queues") Signed-off-by: Michael Baum Acked-by: Matan Azrad --- drivers/net/mlx5/mlx5_rxq.c | 12 +++--------- 1 file changed, 3 insertions(+), 9 deletions(-) diff --git a/drivers/net/mlx5/mlx5_rxq.c b/drivers/net/mlx5/mlx5_rxq.c index 970ce5c..5a11325 100644 --- a/drivers/net/mlx5/mlx5_rxq.c +++ b/drivers/net/mlx5/mlx5_rxq.c @@ -1260,7 +1260,6 @@ container_of(rxq_data, struct mlx5_rxq_ctrl, rxq); struct mlx5_devx_create_rq_attr attr = { 0 }; struct mlx5_rxq_obj *tmpl = NULL; - int ret = 0; uint32_t max_wq_data; assert(rxq_data); @@ -1272,7 +1271,7 @@ "port %u Rx queue %u cannot allocate verbs resources", dev->data->port_id, rxq_data->idx); rte_errno = ENOMEM; - goto error; + return NULL; } tmpl->type = MLX5_RXQ_OBJ_TYPE_DEVX_HAIRPIN; tmpl->rxq_ctrl = rxq_ctrl; @@ -1292,8 +1291,9 @@ DRV_LOG(ERR, "port %u Rx hairpin queue %u can't create rq object", dev->data->port_id, idx); + rte_free(tmpl); rte_errno = errno; - goto error; + return NULL; } DRV_LOG(DEBUG, "port %u rxq %u updated with %p", dev->data->port_id, idx, (void *)&tmpl); @@ -1301,12 +1301,6 @@ LIST_INSERT_HEAD(&priv->rxqsobj, tmpl, next); priv->verbs_alloc_ctx.type = MLX5_VERBS_ALLOC_TYPE_NONE; return tmpl; -error: - ret = rte_errno; /* Save rte_errno before cleanup. */ - if (tmpl->rq) - mlx5_devx_cmd_destroy(tmpl->rq); - rte_errno = ret; /* Restore rte_errno. */ - return NULL; } /** -- 1.8.3.1