diff options
| author | Yevgeny Kliteynik <kliteyn@nvidia.com> | 2024-09-19 12:17:59 +0300 |
|---|---|---|
| committer | Saeed Mahameed <saeedm@nvidia.com> | 2024-09-25 13:15:45 -0700 |
| commit | d8c561741ef83980114b3f7f95ffac54600f3f16 (patch) | |
| tree | deeddd94316bbc2e281daaaab4828927e52ba23b /drivers | |
| parent | 19da17010a55924f2b5540b0f61652cc5781af85 (diff) | |
net/mlx5: HWS, fixed double-free in error flow of creating SQ
When SQ creation fails, call the appropriate mlx5_core destroy function.
This fixes the following smatch warnings:
divers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws_send.c:739
hws_send_ring_open_sq() warn: 'sq->dep_wqe' double freed
hws_send_ring_open_sq() warn: 'sq->wq_ctrl.buf.frags' double freed
hws_send_ring_open_sq() warn: 'sq->wr_priv' double freed
Fixes: 2ca62599aa0b ("net/mlx5: HWS, added send engine and context handling")
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/all/e4ebc227-4b25-49bf-9e4c-14b7ea5c6a07@stanley.mountain/
Signed-off-by: Yevgeny Kliteynik <kliteyn@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws_send.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws_send.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws_send.c index a1adbb48735c..0c7989184c30 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws_send.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws_send.c @@ -653,6 +653,12 @@ static int hws_send_ring_create_sq(struct mlx5_core_dev *mdev, u32 pdn, return err; } +static void hws_send_ring_destroy_sq(struct mlx5_core_dev *mdev, + struct mlx5hws_send_ring_sq *sq) +{ + mlx5_core_destroy_sq(mdev, sq->sqn); +} + static int hws_send_ring_set_sq_rdy(struct mlx5_core_dev *mdev, u32 sqn) { void *in, *sqc; @@ -696,7 +702,7 @@ static int hws_send_ring_create_sq_rdy(struct mlx5_core_dev *mdev, u32 pdn, err = hws_send_ring_set_sq_rdy(mdev, sq->sqn); if (err) - hws_send_ring_close_sq(sq); + hws_send_ring_destroy_sq(mdev, sq); return err; } |