From patchwork Thu Sep 28 21:43:42 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ajit Khaparde X-Patchwork-Id: 29391 X-Patchwork-Delegate: ferruh.yigit@amd.com Return-Path: X-Original-To: patchwork@dpdk.org Delivered-To: patchwork@dpdk.org Received: from [92.243.14.124] (localhost [127.0.0.1]) by dpdk.org (Postfix) with ESMTP id 204CD1B224; Thu, 28 Sep 2017 23:44:27 +0200 (CEST) Received: from rnd-relay.smtp.broadcom.com (lpdvrndsmtp01.broadcom.com [192.19.229.170]) by dpdk.org (Postfix) with ESMTP id 35B111B1BB for ; Thu, 28 Sep 2017 23:44:04 +0200 (CEST) Received: from mail-irv-17.broadcom.com (mail-irv-17.lvn.broadcom.net [10.75.224.233]) by rnd-relay.smtp.broadcom.com (Postfix) with ESMTP id 383A130C05B; Thu, 28 Sep 2017 14:44:03 -0700 (PDT) Received: from C02PT1RBG8WP.vpn.broadcom.net (unknown [10.10.116.190]) by mail-irv-17.broadcom.com (Postfix) with ESMTP id CC70F81EB5; Thu, 28 Sep 2017 14:44:02 -0700 (PDT) From: Ajit Khaparde To: dev@dpdk.org Cc: ferruh.yigit@intel.com Date: Thu, 28 Sep 2017 16:43:42 -0500 Message-Id: <20170928214345.87655-22-ajit.khaparde@broadcom.com> X-Mailer: git-send-email 2.13.5 (Apple Git-94) In-Reply-To: <20170928214345.87655-1-ajit.khaparde@broadcom.com> References: <20170928214345.87655-1-ajit.khaparde@broadcom.com> Subject: [dpdk-dev] [PATCH v4 21/24] net/bnxt: prevent interrupt handler from accessing freed memory X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" In some cases the interrupt handler is accessing cpr, which has already been freed causing segfaults. This patch avoids such accesses. Fixes: 7bc8e9a227cc ("net/bnxt: support async link notification") Signed-off-by: Ajit Khaparde --- drivers/net/bnxt/bnxt_cpr.c | 2 ++ drivers/net/bnxt/bnxt_irq.c | 3 +++ 2 files changed, 5 insertions(+) diff --git a/drivers/net/bnxt/bnxt_cpr.c b/drivers/net/bnxt/bnxt_cpr.c index 68979bc43..26b2755e1 100644 --- a/drivers/net/bnxt/bnxt_cpr.c +++ b/drivers/net/bnxt/bnxt_cpr.c @@ -183,8 +183,10 @@ void bnxt_free_def_cp_ring(struct bnxt *bp) return; bnxt_free_ring(cpr->cp_ring_struct); + cpr->cp_ring_struct = NULL; rte_free(cpr->cp_ring_struct); rte_free(cpr); + bp->def_cp_ring = NULL; } /* For the default completion ring only */ diff --git a/drivers/net/bnxt/bnxt_irq.c b/drivers/net/bnxt/bnxt_irq.c index 47cda7e52..79a119623 100644 --- a/drivers/net/bnxt/bnxt_irq.c +++ b/drivers/net/bnxt/bnxt_irq.c @@ -55,6 +55,9 @@ static void bnxt_int_handler(void *param) struct cmpl_base *cmp; while (1) { + if (!cpr || !cpr->cp_ring_struct) + return; + cons = RING_CMP(cpr->cp_ring_struct, raw_cons); cmp = &cpr->cp_desc_ring[cons];