patches for DPDK stable branches
 help / color / mirror / Atom feed
* [dpdk-stable] [PATCH 19.11 1/2] net/mlx5: fix hairpin Tx queue creation error flow
@ 2020-08-16 12:06 Michael Baum
  2020-08-16 12:06 ` [dpdk-stable] [PATCH 19.11 2/2] net/mlx5: fix hairpin Rx " Michael Baum
  0 siblings, 1 reply; 3+ messages in thread
From: Michael Baum @ 2020-08-16 12:06 UTC (permalink / raw)
  To: stable; +Cc: Matan Azrad, Raslan Darawsheh, Viacheslav Ovsiienko, Michael Baum

[ upstream commit 7e6eba619d6129ec7dcb07d3d0a26785f1c43af6 ]

The mlx5_txq_obj_hairpin_new function defines a pointer named tmpl and
allocates memory for it using the rte_zmalloc_socket function.
Later, this function allocates memory to a variable inside tmpl using
the mlx5_devx_cmd_create_sq function.

In both cases, if the allocation fails, the code jumps to the error
label and frees allocated resources. However, in the first jump there
are still no resources to free and the jump only for the line return
NULL is unnecessary. Even worse, when it jumps to error label with
invalid tmpl it actually does dereference to a null pointer.
In contrast, the second jump needs to free the tmpl variable but the
function instead of freeing, tries to free the variable that it just
failed to allocate, and another variable that has never been allocated.
In addition, for another error, the function returns NULL without
freeing the tmpl variable before, causing a memory leak.

Delete the error label and replace each jump with local return NULL and
free tmpl variable if needed.

Fixes: ae18a1ae9692 ("net/mlx5: support Tx hairpin queues")

Signed-off-by: Michael Baum <>
Acked-by: Matan Azrad <>
 drivers/net/mlx5/mlx5_txq.c | 14 +++-----------
 1 file changed, 3 insertions(+), 11 deletions(-)

diff --git a/drivers/net/mlx5/mlx5_txq.c b/drivers/net/mlx5/mlx5_txq.c
index 0b092c4..f688027 100644
--- a/drivers/net/mlx5/mlx5_txq.c
+++ b/drivers/net/mlx5/mlx5_txq.c
@@ -514,7 +514,6 @@
 		container_of(txq_data, struct mlx5_txq_ctrl, txq);
 	struct mlx5_devx_create_sq_attr attr = { 0 };
 	struct mlx5_txq_obj *tmpl = NULL;
-	int ret = 0;
 	uint32_t max_wq_data;
@@ -526,7 +525,7 @@
 			"port %u Tx queue %u cannot allocate memory resources",
 			dev->data->port_id, txq_data->idx);
 		rte_errno = ENOMEM;
-		goto error;
+		return NULL;
 	tmpl->txq_ctrl = txq_ctrl;
@@ -547,22 +546,15 @@
 			"port %u tx hairpin queue %u can't create sq object",
 			dev->data->port_id, idx);
+		rte_free(tmpl);
 		rte_errno = errno;
-		goto error;
+		return NULL;
 	DRV_LOG(DEBUG, "port %u sxq %u updated with %p", dev->data->port_id,
 		idx, (void *)&tmpl);
 	LIST_INSERT_HEAD(&priv->txqsobj, tmpl, next);
 	return tmpl;
-	ret = rte_errno; /* Save rte_errno before cleanup. */
-	if (tmpl->tis)
-		mlx5_devx_cmd_destroy(tmpl->tis);
-	if (tmpl->sq)
-		mlx5_devx_cmd_destroy(tmpl->sq);
-	rte_errno = ret; /* Restore rte_errno. */
-	return NULL;

^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, other threads:[~2020-08-17  9:42 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-08-16 12:06 [dpdk-stable] [PATCH 19.11 1/2] net/mlx5: fix hairpin Tx queue creation error flow Michael Baum
2020-08-16 12:06 ` [dpdk-stable] [PATCH 19.11 2/2] net/mlx5: fix hairpin Rx " Michael Baum
2020-08-17  9:42   ` Luca Boccassi

patches for DPDK stable branches

This inbox may be cloned and mirrored by anyone:

	git clone --mirror stable/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 stable stable/ \
	public-inbox-index stable

Example config snippet for mirrors.
Newsgroup available over NNTP:

AGPL code for this site: git clone