net/mlx5: fix RxQ resource cleanup
Checks
Commit Message
mlx5_rxq_start() allocates rxq_ctrl->obj and frees it on failure,
but did not set it to NULL. Later mlx5_rxq_release() could not recognize
this object is already freed and attempted to release its resources,
resulting in a crash:
Configuring Port 0 (socket 0)
mlx5_common: Failed to create RQ using DevX
mlx5_common: Can't create DevX RQ object.
mlx5_net: Port 0 Rx queue 0 RQ creation failure.
Segmentation fault
Set rxq_ctrl->obj to NULL after it is freed to skip resource release.
Fixes: 1260a87b2889 ("net/mlx5: share Rx control code")
Cc: Michael Baum <michaelba@nvidia.com>
Cc: stable@dpdk.org
Signed-off-by: Dmitry Kozlyuk <dkozlyuk@nvidia.com>
Acked-by: Matan Azrad <matan@nvidia.com>
---
drivers/net/mlx5/mlx5_trigger.c | 1 +
1 file changed, 1 insertion(+)
Comments
Hi,
> -----Original Message-----
> From: dev <dev-bounces@dpdk.org> On Behalf Of Dmitry Kozlyuk
> Sent: Monday, October 18, 2021 8:25 PM
> To: dev@dpdk.org
> Cc: Michael Baum <michaelba@oss.nvidia.com>; stable@dpdk.org; Matan
> Azrad <matan@oss.nvidia.com>; Viacheslav Ovsiienko
> <viacheslavo@oss.nvidia.com>
> Subject: [dpdk-dev] [PATCH] net/mlx5: fix RxQ resource cleanup
>
> mlx5_rxq_start() allocates rxq_ctrl->obj and frees it on failure, but did not
> set it to NULL. Later mlx5_rxq_release() could not recognize this object is
> already freed and attempted to release its resources, resulting in a crash:
>
> Configuring Port 0 (socket 0)
> mlx5_common: Failed to create RQ using DevX
> mlx5_common: Can't create DevX RQ object.
> mlx5_net: Port 0 Rx queue 0 RQ creation failure.
> Segmentation fault
>
> Set rxq_ctrl->obj to NULL after it is freed to skip resource release.
>
> Fixes: 1260a87b2889 ("net/mlx5: share Rx control code")
> Cc: Michael Baum <michaelba@nvidia.com>
> Cc: stable@dpdk.org
>
> Signed-off-by: Dmitry Kozlyuk <dkozlyuk@nvidia.com>
> Acked-by: Matan Azrad <matan@nvidia.com>
Patch applied to next-net-mlx,
Kindest regards,
Raslan Darawsheh
@@ -182,6 +182,7 @@ mlx5_rxq_start(struct rte_eth_dev *dev)
ret = priv->obj_ops.rxq_obj_new(dev, i);
if (ret) {
mlx5_free(rxq_ctrl->obj);
+ rxq_ctrl->obj = NULL;
goto error;
}
DRV_LOG(DEBUG, "Port %u rxq %u updated with %p.",