From patchwork Thu Sep 28 14:13:26 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ajit Khaparde X-Patchwork-Id: 29358 X-Patchwork-Delegate: ferruh.yigit@amd.com Return-Path: X-Original-To: patchwork@dpdk.org Delivered-To: patchwork@dpdk.org Received: from [92.243.14.124] (localhost [127.0.0.1]) by dpdk.org (Postfix) with ESMTP id B86251B251; Thu, 28 Sep 2017 16:14:21 +0200 (CEST) Received: from rnd-relay.smtp.broadcom.com (lpdvrndsmtp01.broadcom.com [192.19.229.170]) by dpdk.org (Postfix) with ESMTP id 50BE31B206 for ; Thu, 28 Sep 2017 16:13:53 +0200 (CEST) Received: from mail-irv-17.broadcom.com (mail-irv-17.lvn.broadcom.net [10.75.224.233]) by rnd-relay.smtp.broadcom.com (Postfix) with ESMTP id 4954630C013; Thu, 28 Sep 2017 07:13:52 -0700 (PDT) Received: from C02PT1RBG8WP.vpn.broadcom.net (unknown [10.10.116.190]) by mail-irv-17.broadcom.com (Postfix) with ESMTP id E227A81EB5; Thu, 28 Sep 2017 07:13:51 -0700 (PDT) From: Ajit Khaparde To: dev@dpdk.org Cc: ferruh.yigit@intel.com Date: Thu, 28 Sep 2017 09:13:26 -0500 Message-Id: <20170928141329.73874-22-ajit.khaparde@broadcom.com> X-Mailer: git-send-email 2.13.5 (Apple Git-94) In-Reply-To: <20170928141329.73874-1-ajit.khaparde@broadcom.com> References: <20170928141329.73874-1-ajit.khaparde@broadcom.com> Subject: [dpdk-dev] [PATCH v3 21/24] net/bnxt: prevent interrupt handler from accessing freed memory X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" In some cases the interrupt handler is accessing cpr, which has already been freed causing segfaults. This patch avoids such accesses. Fixes: 7bc8e9a227cc ("net/bnxt: support async link notification") Signed-off-by: Ajit Khaparde --- drivers/net/bnxt/bnxt_cpr.c | 2 ++ drivers/net/bnxt/bnxt_irq.c | 3 +++ 2 files changed, 5 insertions(+) diff --git a/drivers/net/bnxt/bnxt_cpr.c b/drivers/net/bnxt/bnxt_cpr.c index 68979bc43..26b2755e1 100644 --- a/drivers/net/bnxt/bnxt_cpr.c +++ b/drivers/net/bnxt/bnxt_cpr.c @@ -183,8 +183,10 @@ void bnxt_free_def_cp_ring(struct bnxt *bp) return; bnxt_free_ring(cpr->cp_ring_struct); + cpr->cp_ring_struct = NULL; rte_free(cpr->cp_ring_struct); rte_free(cpr); + bp->def_cp_ring = NULL; } /* For the default completion ring only */ diff --git a/drivers/net/bnxt/bnxt_irq.c b/drivers/net/bnxt/bnxt_irq.c index 47cda7e52..79a119623 100644 --- a/drivers/net/bnxt/bnxt_irq.c +++ b/drivers/net/bnxt/bnxt_irq.c @@ -55,6 +55,9 @@ static void bnxt_int_handler(void *param) struct cmpl_base *cmp; while (1) { + if (!cpr || !cpr->cp_ring_struct) + return; + cons = RING_CMP(cpr->cp_ring_struct, raw_cons); cmp = &cpr->cp_desc_ring[cons];