net/mlx5: fix memory free on queue create error
Checks
Commit Message
In function mlx5_rxq_ibv_new(), pointer *tmpl allocation is attempted
at the start, but not validated or freed in case of error.
In function mlx5_txq_ibv_new(), pointer *txq_ibv allocation is
attempted at the start, but not freed in case of error.
This patch adds pointers initialization, validation and freeing.
Fixes: 09cb5b581762 ("net/mlx5: separate DPDK from verbs Rx queue objects")
Fixes: faf2667fe8d5 ("net/mlx5: separate DPDK from verbs Tx queue objects")
Cc: stable@dpdk.org
Signed-off-by: Dekel Peled <dekelp@mellanox.com>
---
drivers/net/mlx5/mlx5_rxq.c | 22 +++++++++++++---------
drivers/net/mlx5/mlx5_txq.c | 4 +++-
2 files changed, 16 insertions(+), 10 deletions(-)
Comments
> -----Original Message-----
> From: dev <dev-bounces@dpdk.org> On Behalf Of Dekel Peled
> Sent: Monday, May 20, 2019 11:07 AM
> To: Yongseok Koh <yskoh@mellanox.com>; Shahaf Shuler
> <shahafs@mellanox.com>
> Cc: dev@dpdk.org; Ori Kam <orika@mellanox.com>; stable@dpdk.org
> Subject: [dpdk-dev] [PATCH] net/mlx5: fix memory free on queue create error
>
> In function mlx5_rxq_ibv_new(), pointer *tmpl allocation is attempted
> at the start, but not validated or freed in case of error.
> In function mlx5_txq_ibv_new(), pointer *txq_ibv allocation is
> attempted at the start, but not freed in case of error.
>
> This patch adds pointers initialization, validation and freeing.
>
> Fixes: 09cb5b581762 ("net/mlx5: separate DPDK from verbs Rx queue objects")
> Fixes: faf2667fe8d5 ("net/mlx5: separate DPDK from verbs Tx queue objects")
> Cc: stable@dpdk.org
>
> Signed-off-by: Dekel Peled <dekelp@mellanox.com>
> ---
> drivers/net/mlx5/mlx5_rxq.c | 22 +++++++++++++---------
> drivers/net/mlx5/mlx5_txq.c | 4 +++-
> 2 files changed, 16 insertions(+), 10 deletions(-)
>
> diff --git a/drivers/net/mlx5/mlx5_rxq.c b/drivers/net/mlx5/mlx5_rxq.c
> index a00cb12..8cd6157 100644
> --- a/drivers/net/mlx5/mlx5_rxq.c
> +++ b/drivers/net/mlx5/mlx5_rxq.c
> @@ -776,7 +776,7 @@ struct mlx5_rxq_ibv *
> } attr;
> unsigned int cqe_n;
> unsigned int wqe_n = 1 << rxq_data->elts_n;
> - struct mlx5_rxq_ibv *tmpl;
> + struct mlx5_rxq_ibv *tmpl = NULL;
> struct mlx5dv_cq cq_info;
> struct mlx5dv_rwq rwq;
> unsigned int i;
> @@ -1017,15 +1017,19 @@ struct mlx5_rxq_ibv *
> priv->verbs_alloc_ctx.type = MLX5_VERBS_ALLOC_TYPE_NONE;
> return tmpl;
> error:
> - ret = rte_errno; /* Save rte_errno before cleanup. */
> - if (tmpl->wq)
> - claim_zero(mlx5_glue->destroy_wq(tmpl->wq));
> - if (tmpl->cq)
> - claim_zero(mlx5_glue->destroy_cq(tmpl->cq));
> - if (tmpl->channel)
> - claim_zero(mlx5_glue->destroy_comp_channel(tmpl-
> >channel));
> + if (tmpl) {
> + ret = rte_errno; /* Save rte_errno before cleanup. */
> + if (tmpl->wq)
> + claim_zero(mlx5_glue->destroy_wq(tmpl->wq));
> + if (tmpl->cq)
> + claim_zero(mlx5_glue->destroy_cq(tmpl->cq));
> + if (tmpl->channel)
> + claim_zero(mlx5_glue->destroy_comp_channel
> + (tmpl->channel));
> + rte_free(tmpl);
> + rte_errno = ret; /* Restore rte_errno. */
> + }
> priv->verbs_alloc_ctx.type = MLX5_VERBS_ALLOC_TYPE_NONE;
> - rte_errno = ret; /* Restore rte_errno. */
> return NULL;
> }
>
> diff --git a/drivers/net/mlx5/mlx5_txq.c b/drivers/net/mlx5/mlx5_txq.c
> index b281c45..9efbab6 100644
> --- a/drivers/net/mlx5/mlx5_txq.c
> +++ b/drivers/net/mlx5/mlx5_txq.c
> @@ -401,7 +401,7 @@ struct mlx5_txq_ibv *
> struct mlx5_txq_ctrl *txq_ctrl =
> container_of(txq_data, struct mlx5_txq_ctrl, txq);
> struct mlx5_txq_ibv tmpl;
> - struct mlx5_txq_ibv *txq_ibv;
> + struct mlx5_txq_ibv *txq_ibv = NULL;
> union {
> struct ibv_qp_init_attr_ex init;
> struct ibv_cq_init_attr_ex cq;
> @@ -586,6 +586,8 @@ struct mlx5_txq_ibv *
> claim_zero(mlx5_glue->destroy_cq(tmpl.cq));
> if (tmpl.qp)
> claim_zero(mlx5_glue->destroy_qp(tmpl.qp));
> + if (txq_ibv)
> + rte_free(txq_ibv);
> priv->verbs_alloc_ctx.type = MLX5_VERBS_ALLOC_TYPE_NONE;
> rte_errno = ret; /* Restore rte_errno. */
> return NULL;
> --
> 1.8.3.1
Acked-by: Ori Kam <orika@mellanox.com>
Thanks,
Ori Kam
Monday, May 20, 2019 8:42 PM, Ori Kam:
> Subject: RE: [dpdk-dev] [PATCH] net/mlx5: fix memory free on queue create
> error
>
>
>
> > -----Original Message-----
> > From: dev <dev-bounces@dpdk.org> On Behalf Of Dekel Peled
> > Sent: Monday, May 20, 2019 11:07 AM
> > To: Yongseok Koh <yskoh@mellanox.com>; Shahaf Shuler
> > <shahafs@mellanox.com>
> > Cc: dev@dpdk.org; Ori Kam <orika@mellanox.com>; stable@dpdk.org
> > Subject: [dpdk-dev] [PATCH] net/mlx5: fix memory free on queue create
> > error
> >
> > In function mlx5_rxq_ibv_new(), pointer *tmpl allocation is attempted
> > at the start, but not validated or freed in case of error.
> > In function mlx5_txq_ibv_new(), pointer *txq_ibv allocation is
> > attempted at the start, but not freed in case of error.
> >
> > This patch adds pointers initialization, validation and freeing.
> >
> > Fixes: 09cb5b581762 ("net/mlx5: separate DPDK from verbs Rx queue
> > objects")
> > Fixes: faf2667fe8d5 ("net/mlx5: separate DPDK from verbs Tx queue
> > objects")
> > Cc: stable@dpdk.org
> >
> > Signed-off-by: Dekel Peled <dekelp@mellanox.com>
Applied to next-net-mlx, thanks.
@@ -776,7 +776,7 @@ struct mlx5_rxq_ibv *
} attr;
unsigned int cqe_n;
unsigned int wqe_n = 1 << rxq_data->elts_n;
- struct mlx5_rxq_ibv *tmpl;
+ struct mlx5_rxq_ibv *tmpl = NULL;
struct mlx5dv_cq cq_info;
struct mlx5dv_rwq rwq;
unsigned int i;
@@ -1017,15 +1017,19 @@ struct mlx5_rxq_ibv *
priv->verbs_alloc_ctx.type = MLX5_VERBS_ALLOC_TYPE_NONE;
return tmpl;
error:
- ret = rte_errno; /* Save rte_errno before cleanup. */
- if (tmpl->wq)
- claim_zero(mlx5_glue->destroy_wq(tmpl->wq));
- if (tmpl->cq)
- claim_zero(mlx5_glue->destroy_cq(tmpl->cq));
- if (tmpl->channel)
- claim_zero(mlx5_glue->destroy_comp_channel(tmpl->channel));
+ if (tmpl) {
+ ret = rte_errno; /* Save rte_errno before cleanup. */
+ if (tmpl->wq)
+ claim_zero(mlx5_glue->destroy_wq(tmpl->wq));
+ if (tmpl->cq)
+ claim_zero(mlx5_glue->destroy_cq(tmpl->cq));
+ if (tmpl->channel)
+ claim_zero(mlx5_glue->destroy_comp_channel
+ (tmpl->channel));
+ rte_free(tmpl);
+ rte_errno = ret; /* Restore rte_errno. */
+ }
priv->verbs_alloc_ctx.type = MLX5_VERBS_ALLOC_TYPE_NONE;
- rte_errno = ret; /* Restore rte_errno. */
return NULL;
}
@@ -401,7 +401,7 @@ struct mlx5_txq_ibv *
struct mlx5_txq_ctrl *txq_ctrl =
container_of(txq_data, struct mlx5_txq_ctrl, txq);
struct mlx5_txq_ibv tmpl;
- struct mlx5_txq_ibv *txq_ibv;
+ struct mlx5_txq_ibv *txq_ibv = NULL;
union {
struct ibv_qp_init_attr_ex init;
struct ibv_cq_init_attr_ex cq;
@@ -586,6 +586,8 @@ struct mlx5_txq_ibv *
claim_zero(mlx5_glue->destroy_cq(tmpl.cq));
if (tmpl.qp)
claim_zero(mlx5_glue->destroy_qp(tmpl.qp));
+ if (txq_ibv)
+ rte_free(txq_ibv);
priv->verbs_alloc_ctx.type = MLX5_VERBS_ALLOC_TYPE_NONE;
rte_errno = ret; /* Restore rte_errno. */
return NULL;