Skip to content

Commit

Permalink
net/bnxt: fix double free in port start failure
Browse files Browse the repository at this point in the history
[ upstream commit 39a03b4 ]

During port start when bnxt_start_nic() fails, it tries to free
"intr_handle->intr_vec" but the variable is not set to NULL after that.
If port start fails, driver invokes bnxt_dev_stop() which will lead
to a double free of "intr_handle->intr_vec".

Fix it by removing the call to free "intr_handle->intr_vec" in the
bnxt_start_nic() failure path as it is anyway doing in bnxt_dev_stop().

Fixes: 9d276b4 ("net/bnxt: fix error handling in device start")

Signed-off-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
Reviewed-by: Somnath Kotur <somnath.kotur@broadcom.com>
Reviewed-by: Ajit Khaparde <ajit.khaparde@broadcom.com>
  • Loading branch information
Kalesh AP authored and steevenlee committed May 8, 2021
1 parent f30dc57 commit bc53c25
Showing 1 changed file with 3 additions and 7 deletions.
10 changes: 3 additions & 7 deletions drivers/net/bnxt/bnxt_ethdev.c
Original file line number Diff line number Diff line change
Expand Up @@ -797,7 +797,7 @@ static int bnxt_start_nic(struct bnxt *bp)
PMD_DRV_LOG(ERR, "Failed to allocate %d rx_queues"
" intr_vec", bp->eth_dev->data->nb_rx_queues);
rc = -ENOMEM;
goto err_disable;
goto err_out;
}
PMD_DRV_LOG(DEBUG, "intr_handle->intr_vec = %p "
"intr_handle->nb_efd = %d intr_handle->max_intr = %d\n",
Expand All @@ -817,23 +817,19 @@ static int bnxt_start_nic(struct bnxt *bp)
#ifndef RTE_EXEC_ENV_FREEBSD
/* In FreeBSD OS, nic_uio driver does not support interrupts */
if (rc)
goto err_free;
goto err_out;
#endif

rc = bnxt_update_phy_setting(bp);
if (rc)
goto err_free;
goto err_out;

bp->mark_table = rte_zmalloc("bnxt_mark_table", BNXT_MARK_TABLE_SZ, 0);
if (!bp->mark_table)
PMD_DRV_LOG(ERR, "Allocation of mark table failed\n");

return 0;

err_free:
rte_free(intr_handle->intr_vec);
err_disable:
rte_intr_efd_disable(intr_handle);
err_out:
/* Some of the error status returned by FW may not be from errno.h */
if (rc > 0)
Expand Down

0 comments on commit bc53c25

Please sign in to comment.