From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 7BA56A0A0A for ; Thu, 20 May 2021 11:55:27 +0200 (CEST) Received: from [217.70.189.124] (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 75C41410F9; Thu, 20 May 2021 11:55:27 +0200 (CEST) Received: from relay.smtp-ext.broadcom.com (lpdvacalvio01.broadcom.com [192.19.229.182]) by mails.dpdk.org (Postfix) with ESMTP id D47CD410F5 for ; Thu, 20 May 2021 11:55:25 +0200 (CEST) Received: from dhcp-10-123-153-22.dhcp.broadcom.net (bgccx-dev-host-lnx2.bec.broadcom.net [10.123.153.22]) by relay.smtp-ext.broadcom.com (Postfix) with ESMTP id 8DFB224706 for ; Thu, 20 May 2021 02:55:24 -0700 (PDT) DKIM-Filter: OpenDKIM Filter v2.11.0 relay.smtp-ext.broadcom.com 8DFB224706 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=broadcom.com; s=dkimrelay; t=1621504525; bh=wCVo2NRBLbpoA6S+JTbyFyE4RMdombhhqRwT/9T+hBc=; h=From:To:Subject:Date:In-Reply-To:References:From; b=lCeTBeRzgyB7hygw70Te7C6Ms2A3DGJOfQ1lfjgKjsK9s2Rbml14XtQWY8zmqFu/G rumrfdkb90hjnmH9YxRONDQEkKlDci/HCc7qwCkt4LfMT7sbLt7NbQl1uF4LPseUth 5H/QWJfmj3y8WKlmzMKt6p9tEeQpfKzthtnH1Ngc= From: Kalesh A P To: stable@dpdk.org Date: Thu, 20 May 2021 15:46:48 +0530 Message-Id: <20210520101654.3214-4-kalesh-anakkur.purayil@broadcom.com> X-Mailer: git-send-email 2.10.1 In-Reply-To: <20210520101654.3214-1-kalesh-anakkur.purayil@broadcom.com> References: <20210520101654.3214-1-kalesh-anakkur.purayil@broadcom.com> Subject: [dpdk-stable] [PATCH 19.11 3/9] net/bnxt: fix double free in port start failure X-BeenThere: stable@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: patches for DPDK stable branches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: stable-bounces@dpdk.org Sender: "stable" From: Kalesh AP [ upstream commit 39a03b401e4a72a118bae60c5834be2b6913098e ] During port start when bnxt_start_nic() fails, it tries to free "intr_handle->intr_vec" but the variable is not set to NULL after that. If port start fails, driver invokes bnxt_dev_stop() which will lead to a double free of "intr_handle->intr_vec". Fix it by removing the call to free "intr_handle->intr_vec" in the bnxt_start_nic() failure path as it is anyway doing in bnxt_dev_stop(). Fixes: 9d276b439aaf ("net/bnxt: fix error handling in device start") Signed-off-by: Kalesh AP Reviewed-by: Somnath Kotur Reviewed-by: Ajit Khaparde --- drivers/net/bnxt/bnxt_ethdev.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) diff --git a/drivers/net/bnxt/bnxt_ethdev.c b/drivers/net/bnxt/bnxt_ethdev.c index 26cc3dc..bcdf1fc 100644 --- a/drivers/net/bnxt/bnxt_ethdev.c +++ b/drivers/net/bnxt/bnxt_ethdev.c @@ -442,7 +442,7 @@ static int bnxt_init_chip(struct bnxt *bp) PMD_DRV_LOG(ERR, "Failed to allocate %d rx_queues" " intr_vec", bp->eth_dev->data->nb_rx_queues); rc = -ENOMEM; - goto err_disable; + goto err_out; } PMD_DRV_LOG(DEBUG, "intr_handle->intr_vec = %p " "intr_handle->nb_efd = %d intr_handle->max_intr = %d\n", @@ -462,13 +462,13 @@ static int bnxt_init_chip(struct bnxt *bp) #ifndef RTE_EXEC_ENV_FREEBSD /* In FreeBSD OS, nic_uio driver does not support interrupts */ if (rc) - goto err_free; + goto err_out; #endif rc = bnxt_get_hwrm_link_config(bp, &new); if (rc) { PMD_DRV_LOG(ERR, "HWRM Get link config failure rc: %x\n", rc); - goto err_free; + goto err_out; } if (!bp->link_info.link_up) { @@ -476,17 +476,13 @@ static int bnxt_init_chip(struct bnxt *bp) if (rc) { PMD_DRV_LOG(ERR, "HWRM link config failure rc: %x\n", rc); - goto err_free; + goto err_out; } } bnxt_print_link_info(bp->eth_dev); return 0; -err_free: - rte_free(intr_handle->intr_vec); -err_disable: - rte_intr_efd_disable(intr_handle); err_out: /* Some of the error status returned by FW may not be from errno.h */ if (rc > 0) -- 2.10.1