[1/6] net/mlx5: fix hairpin Tx queue creation error flow
diff mbox series

Message ID 1590568677-11662-1-git-send-email-michaelba@mellanox.com
State Accepted
Delegated to: Raslan Darawsheh
Headers show
Series
  • [1/6] net/mlx5: fix hairpin Tx queue creation error flow
Related show

Checks

Context Check Description
ci/Intel-compilation fail Compilation issues
ci/iol-testing warning Testing issues
ci/iol-mellanox-Performance success Performance Testing PASS
ci/iol-nxp-Performance success Performance Testing PASS
ci/iol-intel-Performance success Performance Testing PASS
ci/checkpatch success coding style OK

Commit Message

Michael Baum May 27, 2020, 8:37 a.m. UTC
The mlx5_txq_obj_hairpin_new function defines a pointer named tmpl and
allocates memory for it using the rte_zmalloc_socket function.
Later, this function allocates memory to a variable inside tmpl using
the mlx5_devx_cmd_create_sq function.

In both cases, if the allocation fails, the code jumps to the error
label and frees allocated resources. However, in the first jump there
are still no resources to free and the jump only for the line return
NULL is unnecessary. Even worse, when it jumps to error label with
invalid tmpl it actually does dereference to a null pointer.
In contrast, the second jump needs to free the tmpl variable but the
function instead of freeing, tries to free the variable that it just
failed to allocate, and another variable that has never been allocated.
In addition, for another error, the function returns NULL without
freeing the tmpl variable before, causing a memory leak.

Delete the error label and replace each jump with local return NULL and
free tmpl variable if needed.

Fixes: ae18a1ae9692 ("net/mlx5: support Tx hairpin queues")
Cc: stable@dpdk.org

Signed-off-by: Michael Baum <michaelba@mellanox.com>
Acked-by: Matan Azrad <matan@mellanox.com>
---
 drivers/net/mlx5/mlx5_txq.c | 15 ++++-----------
 1 file changed, 4 insertions(+), 11 deletions(-)

Comments

Raslan Darawsheh May 31, 2020, 11:26 a.m. UTC | #1
Hi,

> -----Original Message-----
> From: dev <dev-bounces@dpdk.org> On Behalf Of Michael Baum
> Sent: Wednesday, May 27, 2020 11:38 AM
> To: dev@dpdk.org
> Cc: Matan Azrad <matan@mellanox.com>; Slava Ovsiienko
> <viacheslavo@mellanox.com>; stable@dpdk.org
> Subject: [dpdk-dev] [PATCH 1/6] net/mlx5: fix hairpin Tx queue creation
> error flow
> 
> The mlx5_txq_obj_hairpin_new function defines a pointer named tmpl and
> allocates memory for it using the rte_zmalloc_socket function.
> Later, this function allocates memory to a variable inside tmpl using
> the mlx5_devx_cmd_create_sq function.
> 
> In both cases, if the allocation fails, the code jumps to the error
> label and frees allocated resources. However, in the first jump there
> are still no resources to free and the jump only for the line return
> NULL is unnecessary. Even worse, when it jumps to error label with
> invalid tmpl it actually does dereference to a null pointer.
> In contrast, the second jump needs to free the tmpl variable but the
> function instead of freeing, tries to free the variable that it just
> failed to allocate, and another variable that has never been allocated.
> In addition, for another error, the function returns NULL without
> freeing the tmpl variable before, causing a memory leak.
> 
> Delete the error label and replace each jump with local return NULL and
> free tmpl variable if needed.
> 
> Fixes: ae18a1ae9692 ("net/mlx5: support Tx hairpin queues")
> Cc: stable@dpdk.org
> 
> Signed-off-by: Michael Baum <michaelba@mellanox.com>
> Acked-by: Matan Azrad <matan@mellanox.com>
> ---
>  drivers/net/mlx5/mlx5_txq.c | 15 ++++-----------
>  1 file changed, 4 insertions(+), 11 deletions(-)
> 

Series applied to next-net-mlx,

Kindest regards,
Raslan Darawsheh

Patch
diff mbox series

diff --git a/drivers/net/mlx5/mlx5_txq.c b/drivers/net/mlx5/mlx5_txq.c
index a211fa9..7cc620a 100644
--- a/drivers/net/mlx5/mlx5_txq.c
+++ b/drivers/net/mlx5/mlx5_txq.c
@@ -493,7 +493,6 @@ 
 		container_of(txq_data, struct mlx5_txq_ctrl, txq);
 	struct mlx5_devx_create_sq_attr attr = { 0 };
 	struct mlx5_txq_obj *tmpl = NULL;
-	int ret = 0;
 	uint32_t max_wq_data;
 
 	MLX5_ASSERT(txq_data);
@@ -505,7 +504,7 @@ 
 			"port %u Tx queue %u cannot allocate memory resources",
 			dev->data->port_id, txq_data->idx);
 		rte_errno = ENOMEM;
-		goto error;
+		return NULL;
 	}
 	tmpl->type = MLX5_TXQ_OBJ_TYPE_DEVX_HAIRPIN;
 	tmpl->txq_ctrl = txq_ctrl;
@@ -518,6 +517,7 @@ 
 			DRV_LOG(ERR, "total data size %u power of 2 is "
 				"too large for hairpin",
 				priv->config.log_hp_size);
+			rte_free(tmpl);
 			rte_errno = ERANGE;
 			return NULL;
 		}
@@ -537,22 +537,15 @@ 
 		DRV_LOG(ERR,
 			"port %u tx hairpin queue %u can't create sq object",
 			dev->data->port_id, idx);
+		rte_free(tmpl);
 		rte_errno = errno;
-		goto error;
+		return NULL;
 	}
 	DRV_LOG(DEBUG, "port %u sxq %u updated with %p", dev->data->port_id,
 		idx, (void *)&tmpl);
 	rte_atomic32_inc(&tmpl->refcnt);
 	LIST_INSERT_HEAD(&priv->txqsobj, tmpl, next);
 	return tmpl;
-error:
-	ret = rte_errno; /* Save rte_errno before cleanup. */
-	if (tmpl->tis)
-		mlx5_devx_cmd_destroy(tmpl->tis);
-	if (tmpl->sq)
-		mlx5_devx_cmd_destroy(tmpl->sq);
-	rte_errno = ret; /* Restore rte_errno. */
-	return NULL;
 }
 
 /**