diff mbox series

net/bnxt: fix free of not allocated object

Message ID 20250521193727.382342-1-stephen@networkplumber.org (mailing list archive)
State New
Delegated to: Ajit Khaparde
Headers
Series net/bnxt: fix free of not allocated object |

Checks

Context Check Description
ci/checkpatch success coding style OK
ci/loongarch-compilation success Compilation OK
ci/loongarch-unit-testing success Unit Testing PASS
ci/Intel-compilation success Compilation OK
ci/intel-Testing success Testing PASS
ci/github-robot: build success github build: passed
ci/intel-Functional success Functional PASS
ci/iol-marvell-Functional success Functional Testing PASS
ci/iol-mellanox-Performance success Performance Testing PASS
ci/iol-intel-Performance success Performance Testing PASS
ci/iol-intel-Functional success Functional Testing PASS
ci/iol-abi-testing success Testing PASS
ci/iol-broadcom-Performance success Performance Testing PASS
ci/iol-compile-arm64-testing success Testing PASS
ci/iol-compile-amd64-testing warning Testing issues
ci/iol-unit-amd64-testing success Testing PASS
ci/iol-sample-apps-testing success Testing PASS
ci/aws-unit-testing success Unit Testing PASS

Commit Message

Stephen Hemminger May 21, 2025, 7:37 p.m. UTC 
This was found as error when compiling with LTO.
The function allocates new data with rte_zmalloc and then
stores pointer in the pointer-to-pointer passed as argument.
In the unwind case, it would call rte_free() with wrong one.

Fixes: 80317ff6adfd ("net/bnxt/tf_core: support Thor2")

Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
---
 drivers/net/bnxt/tf_core/v3/tfo.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

Comments

Stephen Hemminger June 17, 2025, 1:51 p.m. UTC | #1 
On Wed, 21 May 2025 12:37:27 -0700
Stephen Hemminger <stephen@networkplumber.org> wrote:

> This was found as error when compiling with LTO.
> The function allocates new data with rte_zmalloc and then
> stores pointer in the pointer-to-pointer passed as argument.
> In the unwind case, it would call rte_free() with wrong one.
> 
> Fixes: 80317ff6adfd ("net/bnxt/tf_core: support Thor2")
> 
> Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
> ---
>  drivers/net/bnxt/tf_core/v3/tfo.c | 8 +++-----
>  1 file changed, 3 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/net/bnxt/tf_core/v3/tfo.c b/drivers/net/bnxt/tf_core/v3/tfo.c
> index bee813ebf6..c888dd1e4e 100644
> --- a/drivers/net/bnxt/tf_core/v3/tfo.c
> +++ b/drivers/net/bnxt/tf_core/v3/tfo.c
> @@ -74,9 +74,7 @@ void tfo_open(void **tfo, bool is_pf)
>  	rc = cfa_bld_mpc_bind(CFA_P70, &tfco->mpc_info);
>  	if (rc) {
>  		PMD_DRV_LOG_LINE(ERR, "MPC bind failed");
> -		rte_free(tfco);
> -		*tfo = NULL;
> -		return;
> +		goto cleanup;
>  	}
>  	if (is_pf) {
>  		/* Allocate TIM */
> @@ -104,8 +102,8 @@ void tfo_open(void **tfo, bool is_pf)
>  	return;
>  
>   cleanup:
> -	if (tfco != NULL)
> -		rte_free(tfo);
> +	rte_free(tfco);
> +	*tfo = NULL;
>  }
>  
>  void tfo_close(void **tfo)

Ping. This is a bug fix which seems to have gotten no response.
diff mbox series

Patch

diff --git a/drivers/net/bnxt/tf_core/v3/tfo.c b/drivers/net/bnxt/tf_core/v3/tfo.c
index bee813ebf6..c888dd1e4e 100644
--- a/drivers/net/bnxt/tf_core/v3/tfo.c
+++ b/drivers/net/bnxt/tf_core/v3/tfo.c
@@ -74,9 +74,7 @@  void tfo_open(void **tfo, bool is_pf)
 	rc = cfa_bld_mpc_bind(CFA_P70, &tfco->mpc_info);
 	if (rc) {
 		PMD_DRV_LOG_LINE(ERR, "MPC bind failed");
-		rte_free(tfco);
-		*tfo = NULL;
-		return;
+		goto cleanup;
 	}
 	if (is_pf) {
 		/* Allocate TIM */
@@ -104,8 +102,8 @@  void tfo_open(void **tfo, bool is_pf)
 	return;
 
  cleanup:
-	if (tfco != NULL)
-		rte_free(tfo);
+	rte_free(tfco);
+	*tfo = NULL;
 }
 
 void tfo_close(void **tfo)