Skip to contentSkip to conversation

baseband/acc100: fix a memory leak in acc100 queue setup

PATCH In review Weiguo Li 5 participants 27 messages Feb 22, 2022 – Jun 24, 2022 1 message not in the archive

Subsystems (3)
lore
Share & tools
lore

A message that is not in the archive (sent off-list or not yet received): [email protected]

Weiguo Li

author
#1 lore raw

PATCH 1/20 baseband/acc100: fix a memory leak in acc100 queue setup

We allocated memory for 'q', we don't free it when null check for 'd' fails and it will lead to memory leak.
We can move null check for 'd' ahead of the memory allocation to fix it.

Fixes 060e76729302 ("baseband/acc100: add queue configuration")
---
 drivers/baseband/acc100/rte_acc100_pmd.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/baseband/acc100/rte_acc100_pmd.c +4 -4
index f86474f7e0..25e9e6435f 100644
@@ -824,6 +824,10 @@ acc100_queue_setup(struct rte_bbdev *dev, uint16_t queue_id,
 	struct acc100_queue *q;
 	int16_t q_idx;
 
+	if (d == NULL) {
+		rte_bbdev_log(ERR, "Undefined device");
+		return -ENODEV;
+	}
 	/* Allocate the queue data structure. */
 	q = rte_zmalloc_socket(dev->device->driver->name, sizeof(*q),
 			RTE_CACHE_LINE_SIZE, conf->socket);
@@ -831,10 +835,6 @@ acc100_queue_setup(struct rte_bbdev *dev, uint16_t queue_id,
 		rte_bbdev_log(ERR, "Failed to allocate queue memory");
 		return -ENOMEM;
 	}
-	if (d == NULL) {
-		rte_bbdev_log(ERR, "Undefined device");
-		return -ENODEV;
-	}
 
 	q->d = d;
 	q->ring_addr = RTE_PTR_ADD(d->sw_rings, (d->sw_ring_size * queue_id));
Signature · 1 line
2.25.1
Acked-by Nicolas Chautru on v1 1/20
#2 lore raw
Quoted 41 lines

From: Weiguo Li <[email protected]>

We allocated memory for 'q', we don't free it when null check for 'd' fails and it will lead to memory leak.
We can move null check for 'd' ahead of the memory allocation to fix it.

Fixes 060e76729302 ("baseband/acc100: add queue configuration")
---
 drivers/baseband/acc100/rte_acc100_pmd.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/baseband/acc100/rte_acc100_pmd.c +4 -0
index f86474f7e0..25e9e6435f 100644
@@ -824,6 +824,10 @@ acc100_queue_setup(struct rte_bbdev *dev,
 uint16_t queue_id,
 	struct acc100_queue *q;
 	int16_t q_idx;
 
+	if (d == NULL) {
+		rte_bbdev_log(ERR, "Undefined device");
+		return -ENODEV;
+	}
 	/* Allocate the queue data structure. */
 	q = rte_zmalloc_socket(dev->device->driver->name, sizeof(*q),
drivers/baseband/acc100/rte_acc100_pmd.c +0 -4
 			RTE_CACHE_LINE_SIZE, conf->socket);
@@ -831,10 +835,6 @@ acc100_queue_setup(struct rte_bbdev *dev,
 uint16_t queue_id,
 		rte_bbdev_log(ERR, "Failed to allocate queue memory");
 		return -ENOMEM;
 	}
-	if (d == NULL) {
-		rte_bbdev_log(ERR, "Undefined device");
-		return -ENODEV;
-	}
 
 	q->d = d;
Quoted 5 lines

q->ring_addr = RTE_PTR_ADD(d->sw_rings, (d->sw_ring_size *
queue_id));
--
2.25.1

Thanks

#3 lore raw
In reply to Weiguo Li
Quoted 17 lines · Weiguo Li

We allocated memory for 'q', we don't free it when null check for 'd' fails and it will lead to memory leak.
We can move null check for 'd' ahead of the memory allocation to fix it.

Fixes 060e76729302 ("baseband/acc100: add queue configuration")
---
 drivers/baseband/acc100/rte_acc100_pmd.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/baseband/acc100/rte_acc100_pmd.c +0 -0
index f86474f7e0..25e9e6435f 100644

drivers/baseband/acc100/rte_acc100_pmd.c acc100_queue_setup(struct rte_bbdev *dev, uint16_t queue_id, · line 830

Quoted 7 lines
drivers/baseband/acc100/rte_acc100_pmd.c +4 -0
@@ -824,6 +824,10 @@ acc100_queue_setup(struct rte_bbdev *dev, uint16_t queue_id,
        struct acc100_queue *q;
        int16_t q_idx;
 
+       if (d == NULL) {
+               rte_bbdev_log(ERR, "Undefined device");
+               return -ENODEV;
+       }

Nicolas,

.queue_setup is a dev_ops, which means it is invoked after the .probe function was called.
Failing to allocate dev_private shoud have been detected earlier, is that correct?
If so, this check should simply be dropped, and there is no leak to fix.

Please confirm when you have the time.

Thanks.

Signature · 1 line
David Marchand
author
#4 lore raw

PATCH 2/20 common/dpaax: fix a memory leak in iterate dir

In reply to a message not in the archive

When process_dir() fails, the memory to 'subdir' was not freed which caused a memory leak.

Fixes 2183c6f69d7e ("bus/dpaa: add OF parser for device scanning")
---
 drivers/common/dpaax/dpaa_of.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/common/dpaax/dpaa_of.c +3 -1
index bb2c8fc66b..a827b42efa 100644
@@ -126,8 +126,10 @@ iterate_dir(struct dirent **d, int num, struct dt_dir *dt)
 				 d[loop]->d_name);
 			subdir->parent = dt;
 			ret = process_dir(subdir->node.node.full_name, subdir);
-			if (ret)
+			if (ret) {
+				free(subdir);
 				return ret;
+			}
 			list_add_tail(&subdir->node.list, &dt->subdirs);
 			break;
 		default:
Signature · 1 line
2.25.1
author
#5 lore raw

PATCH 3/20 crypto/dpaa2_sec: fix memory leaks in error handlings

In reply to a message not in the archive

When function returned from error handling branches, the memories were not freed which caused a memory leak.

Fixes 8d1f3a5d751b ("crypto/dpaa2_sec: support crypto operation")
---
 drivers/crypto/dpaa2_sec/dpaa2_sec_dpseci.c | 3 +++
 1 file changed, 3 insertions(+)
drivers/crypto/dpaa2_sec/dpaa2_sec_dpseci.c +3 -0
index e62d04852b..3f8d4d213f 100644
@@ -2037,12 +2037,15 @@ dpaa2_sec_queue_pair_setup(struct rte_cryptodev *dev, uint16_t qp_id,
 		RTE_CACHE_LINE_SIZE);
 	if (!qp->rx_vq.q_storage) {
 		DPAA2_SEC_ERR("malloc failed for q_storage");
+		rte_free(qp);
 		return -ENOMEM;
 	}
 	memset(qp->rx_vq.q_storage, 0, sizeof(struct queue_storage_info_t));
 
 	if (dpaa2_alloc_dq_storage(qp->rx_vq.q_storage)) {
 		DPAA2_SEC_ERR("Unable to allocate dequeue storage");
+		rte_free(qp->rx_vq.q_storage);
+		rte_free(qp);
 		return -ENOMEM;
 	}
 
Signature · 1 line
2.25.1
#6 lore raw

Re: [PATCH 03/20] crypto/dpaa2_sec: fix memory leaks in error handlings

Quoted 5 lines · Weiguo Li

When function returned from error handling branches, the memories were not freed which caused a memory leak.

Fixes 8d1f3a5d751b ("crypto/dpaa2_sec: support crypto operation")

This is backport material.
Please add Cc: [email protected] in new revision.

Quoted 15 lines
---
 drivers/crypto/dpaa2_sec/dpaa2_sec_dpseci.c | 3 +++
 1 file changed, 3 insertions(+)
drivers/crypto/dpaa2_sec/dpaa2_sec_dpseci.c +1 -0
index e62d04852b..3f8d4d213f 100644
@@ -2037,12 +2037,15 @@ dpaa2_sec_queue_pair_setup(struct rte_cryptodev *dev, uint16_t qp_id,
                RTE_CACHE_LINE_SIZE);
        if (!qp->rx_vq.q_storage) {
                DPAA2_SEC_ERR("malloc failed for q_storage");
+               rte_free(qp);

drivers/crypto/dpaa2_sec/dpaa2_sec_dpseci.c dpaa2_sec_queue_pair_setup(struct rte_cryptodev *dev, uint16_t qp_id, · line 2050

Quoted 10 lines
drivers/crypto/dpaa2_sec/dpaa2_sec_dpseci.c +2 -0
                return -ENOMEM;
        }
        memset(qp->rx_vq.q_storage, 0, sizeof(struct queue_storage_info_t));
 
        if (dpaa2_alloc_dq_storage(qp->rx_vq.q_storage)) {
                DPAA2_SEC_ERR("Unable to allocate dequeue storage");
+               rte_free(qp->rx_vq.q_storage);
+               rte_free(qp);
                return -ENOMEM;
        }

Please rebase this fix, there was a new allocation introduced in this code and I suspect this should be fixed too.
Thanks.

Signature · 1 line
David Marchand
author
#7 lore raw

PATCH 4/20 crypto/qat: fix a memory leak when set encrypt key fail

In reply to a message not in the archive

We allocated memory for 'in', we don't free it when AES_set_encrypt_key() fails and it will lead to memory leak.
We can move set_encrypt_key() ahead of the memory allocation to fix it.

Fixes 1703e94ac5ce ("qat: add driver for QuickAssist devices")
---
 drivers/crypto/qat/qat_sym_session.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)
drivers/crypto/qat/qat_sym_session.c +4 -5
index 8ca475ca8b..3dc13942cb 100644
@@ -1400,18 +1400,17 @@ static int qat_sym_do_precomputes(enum icp_qat_hw_auth_algo hash_alg,
 		memset(p_state_buf, 0, ICP_QAT_HW_GALOIS_H_SZ +
 				ICP_QAT_HW_GALOIS_LEN_A_SZ +
 				ICP_QAT_HW_GALOIS_E_CTR0_SZ);
+		if (AES_set_encrypt_key(auth_key, auth_keylen << 3,
+			&enc_key) != 0) {
+			return -EFAULT;
+		}
 		in = rte_zmalloc("working mem for key",
 				ICP_QAT_HW_GALOIS_H_SZ, 16);
 		if (in == NULL) {
 			QAT_LOG(ERR, "Failed to alloc memory");
 			return -ENOMEM;
 		}
-
 		memset(in, 0, ICP_QAT_HW_GALOIS_H_SZ);
-		if (AES_set_encrypt_key(auth_key, auth_keylen << 3,
-			&enc_key) != 0) {
-			return -EFAULT;
-		}
 		AES_encrypt(in, out, &enc_key);
 		*p_state_len = ICP_QAT_HW_GALOIS_H_SZ +
 				ICP_QAT_HW_GALOIS_LEN_A_SZ +
Signature · 1 line
2.25.1
#8 lore raw

Re: [PATCH 04/20] crypto/qat: fix a memory leak when set encrypt key fail

Quoted 4 lines · Weiguo Li

We allocated memory for 'in', we don't free it when AES_set_encrypt_key() fails and it will lead to memory leak.
We can move set_encrypt_key() ahead of the memory allocation to fix it.

This move seems to fix the leak indeed.
But this change does not follow the pattern used in the rest of this file and I don't feel confident enough to accept it without the driver maintainer opinion.

Signature · 1 line
David Marchand
author
#9 lore raw

PATCH 5/20 net/bnxt: fix a memory leak in error handling

In reply to a message not in the archive

When run goto from this branch, the 'ulp_fc_info' has not set into the context yet, so ulp_fc_mgr_deinit(ctxt) in the error label can not release 'ulp_fc_info' in this case which cause a memory leak.

Fixes 9cf9c8385df7 ("net/bnxt: add ULP flow counter manager")
---
 drivers/net/bnxt/tf_ulp/ulp_fc_mgr.c | 1 +
 1 file changed, 1 insertion(+)
drivers/net/bnxt/tf_ulp/ulp_fc_mgr.c +1 -0
index 85c9cbb7f2..b055463ea4 100644
@@ -86,6 +86,7 @@ ulp_fc_mgr_init(struct bnxt_ulp_context *ctxt)
 
 	rc = pthread_mutex_init(&ulp_fc_info->fc_lock, NULL);
 	if (rc) {
+		rte_free(ulp_fc_info);
 		PMD_DRV_LOG(ERR, "Failed to initialize fc mutex\n");
 		goto error;
 	}
Signature · 1 line
2.25.1
author
#10 lore raw

PATCH 6/20 net/bnxt: fix 'ctx' memory leak when new malloc fail

In reply to a message not in the archive

When new memory is not available and the memory "ctx" allocated beforehand was not assigned to anywhere, so "ctx" should be freed, otherwise will cause a memory leak.

Fixes b4f740511655 ("net/bnxt: remove unnecessary return check")
---
 drivers/net/bnxt/bnxt_hwrm.c | 1 +
 1 file changed, 1 insertion(+)
drivers/net/bnxt/bnxt_hwrm.c +1 -0
index b4aeec593e..4993111ccf 100644
@@ -5374,6 +5374,7 @@ int bnxt_hwrm_func_backing_store_qcaps(struct bnxt *bp)
 			    RTE_CACHE_LINE_SIZE);
 	if (!ctx_pg) {
 		rc = -ENOMEM;
+		rte_free(ctx);
 		goto ctx_err;
 	}
 	for (i = 0; i < tqm_rings; i++, ctx_pg++)
Signature · 1 line
2.25.1
author
#11 lore raw

PATCH 7/20 net/bnx2x: add clean up for 'rxq' to avoid a memory leak

In reply to a message not in the archive

This error handling miss a clean up for 'rxq' which leads to a memory leak.

Fixes 540a211084a7 ("bnx2x: driver core")
---
 drivers/net/bnx2x/bnx2x_rxtx.c | 1 +
 1 file changed, 1 insertion(+)
drivers/net/bnx2x/bnx2x_rxtx.c +1 -0
index fbc0bb7698..9ad36000fb 100644
@@ -139,6 +139,7 @@ bnx2x_dev_rx_queue_setup(struct rte_eth_dev *dev,
 	dma = ring_dma_zone_reserve(dev, "bnx2x_rcq", queue_idx, dma_size, socket_id);
 	if (NULL == dma) {
 		PMD_RX_LOG(ERR, "RCQ  alloc failed");
+		bnx2x_rx_queue_release(rxq);
 		return -ENOMEM;
 	}
 	fp->rx_comp_mapping = rxq->cq_ring_phys_addr = (uint64_t)dma->iova;
Signature · 1 line
2.25.1
author
#12 lore raw

PATCH 8/20 net/cnxk: free 'node' memory when node add fail

In reply to a message not in the archive

When node_add failed and function return, then the memory of 'node' is leaked.

Fixes 4435371b8fb1c0 ("net/cnxk: add TM shaper and node operations")
---
 drivers/net/cnxk/cnxk_tm.c | 1 +
 1 file changed, 1 insertion(+)
drivers/net/cnxk/cnxk_tm.c +1 -0
index 9015a452f8..81afafd5b7 100644
@@ -389,6 +389,7 @@ cnxk_nix_tm_node_add(struct rte_eth_dev *eth_dev, uint32_t node_id,
 	if (rc < 0) {
 		error->type = roc_nix_tm_err_to_rte_err(rc);
 		error->message = roc_error_msg_get(rc);
+		rte_free(node);
 		return rc;
 	}
 	error->type = RTE_TM_ERROR_TYPE_NONE;
Signature · 1 line
2.25.1
Acked-by on v1 8/20
#13 lore raw

Re: [PATCH 08/20] net/cnxk: free 'node' memory when node add fail

Quoted 22 lines · Weiguo Li

When node_add failed and function return, then the memory of 'node' is leaked.

Fixes 4435371b8fb1c0 ("net/cnxk: add TM shaper and node operations")
---
  drivers/net/cnxk/cnxk_tm.c | 1 +
  1 file changed, 1 insertion(+)
drivers/net/cnxk/cnxk_tm.c +1 -0
index 9015a452f8..81afafd5b7 100644
@@ -389,6 +389,7 @@ cnxk_nix_tm_node_add(struct rte_eth_dev *eth_dev, uint32_t node_id,
  	if (rc < 0) {
  		error->type = roc_nix_tm_err_to_rte_err(rc);
  		error->message = roc_error_msg_get(rc);
+		rte_free(node);
  		return rc;
  	}
  	error->type = RTE_TM_ERROR_TYPE_NONE;
author
#14 lore raw

PATCH 9/20 net/dpaa: fix a memory leak when validation fail

In reply to a message not in the archive

When buf_len validations fails and return, the mbuf is not freed which caused a memory leak.

Fixes 8cffdcbe85aa ("net/dpaa: support scattered Rx")
---
 drivers/net/dpaa/dpaa_rxtx.c | 1 +
 1 file changed, 1 insertion(+)
drivers/net/dpaa/dpaa_rxtx.c +1 -0
index 956fe946fa..f66d975969 100644
@@ -810,6 +810,7 @@ dpaa_eth_mbuf_to_sg_fd(struct rte_mbuf *mbuf,
 	}
 	if (temp->buf_len < ((mbuf->nb_segs * sizeof(struct qm_sg_entry))
 				+ temp->data_off)) {
+		rte_pktmbuf_free(temp);
 		DPAA_PMD_ERR("Insufficient space in mbuf for SG entries");
 		return -1;
 	}
Signature · 1 line
2.25.1
author
#15 lore raw

PATCH 10/20 net/failsafe: fix a memory leak in error handling

In reply to a message not in the archive

When failed at 'rte_intr_efd_enable()', function returned and 'rxq' is not freed. So free 'rxq' in error handling to avoid a memory leak. We can't not use 'goto free_rxq' instead since 'rxq' has not assigned to 'dev->data->rx_queues[rx_queue_id]', thus 'fs_rx_queue_release(dev,...)' will not work in this case.

Fixes 9e0360aebf236d ("net/failsafe: register as Rx interrupt mode")
---
 drivers/net/failsafe/failsafe_ops.c | 1 +
 1 file changed, 1 insertion(+)
drivers/net/failsafe/failsafe_ops.c +1 -0
index 55e21d635c..4d4e2b248f 100644
@@ -444,6 +444,7 @@ fs_rx_queue_setup(struct rte_eth_dev *dev,
 	rxq->sdev = PRIV(dev)->subs;
 	ret = rte_intr_efd_enable(intr_handle, 1);
 	if (ret < 0) {
+		rte_free(rxq);
 		fs_unlock(dev, 0);
 		return ret;
 	}
Signature · 1 line
2.25.1
author
#16 lore raw

PATCH 11/20 net/iavf: fix a memory leak in error handling

In reply to a message not in the archive

When function return from this branch, memory for 'items' is not freed which caused a memory leak.

Fixes ff2d0c345c3b ("net/iavf: support generic flow API")
---
 drivers/net/iavf/iavf_generic_flow.c | 1 +
 1 file changed, 1 insertion(+)
drivers/net/iavf/iavf_generic_flow.c +1 -0
index 2befa125ac..a733ebc613 100644
@@ -2013,6 +2013,7 @@ iavf_search_pattern_match_item(const struct rte_flow_item pattern[],
 	pattern_match_item = rte_zmalloc("iavf_pattern_match_item",
 				sizeof(struct iavf_pattern_match_item), 0);
 	if (!pattern_match_item) {
+		rte_free(items);
 		rte_flow_error_set(error, ENOMEM, RTE_FLOW_ERROR_TYPE_HANDLE,
 				   NULL, "Failed to allocate memory.");
 		return NULL;
Signature · 1 line
2.25.1
author
#17 lore raw

PATCH 12/20 net/ice: goto clean up lable to avoid memory leak

In reply to a message not in the archive

When function return in this branch, the memories of 'input' and 'rule' are not released, goto corresponding lable to do the clean up.

Fixes 40d466fa9f765b ("net/ice: support ACL filter in DCF")
---
 drivers/net/ice/ice_acl_filter.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ice/ice_acl_filter.c +1 -1
index 8fe6f5aeb0..5ddc5262d4 100644
@@ -530,7 +530,7 @@ ice_acl_create_filter(struct ice_adapter *ad,
 				   RTE_FLOW_ERROR_TYPE_HANDLE, NULL,
 				   "failed to set hw configure.");
 		ret = -rte_errno;
-		return ret;
+		goto err_acl_set_input;
 	}
 
 	if (flow_type == ICE_FLTR_PTYPE_NONF_IPV4_OTHER) {
Signature · 1 line
2.25.1
author
#18 lore raw

PATCH 13/20 net/ice: fix memory leaks in error handlings

In reply to a message not in the archive

The function release 'pkt_buf' and 'msk_buf' when successful. In some error handlings, 'pkt_buf' and 'msk_buf' were not freed leads to memory leaks.
To fix it without introducing code redundancy, add and make use of an 'error' lable to do the clean ups for 'pkt_buf' and 'msk_buf'.

Fixes 1b9c68120a1c50 ("net/ice: enable protocol agnostic flow offloading in RSS")
---
 drivers/net/ice/ice_hash.c | 30 +++++++++++++++++++-----------
 1 file changed, 19 insertions(+), 11 deletions(-)
drivers/net/ice/ice_hash.c +19 -11
index afbb357fa3..aed256d57c 100644
@@ -658,7 +658,7 @@ ice_hash_parse_raw_pattern(struct ice_adapter *ad,
 	uint8_t spec_len, pkt_len;
 	uint8_t tmp_val = 0;
 	uint8_t tmp_c = 0;
-	int i, j;
+	int i, j, ret = 0;
 
 	raw_spec = item->spec;
 	raw_mask = item->mask;
@@ -675,9 +675,10 @@ ice_hash_parse_raw_pattern(struct ice_adapter *ad,
 		return -ENOMEM;
 
 	msk_buf = rte_zmalloc(NULL, pkt_len, 0);
-	if (!msk_buf)
-		return -ENOMEM;
-
+	if (!msk_buf) {
+		ret = -ENOMEM;
+		goto exit;
+	}
 	/* convert string to int array */
 	for (i = 0, j = 0; i < spec_len; i += 2, j++) {
 		tmp_c = raw_spec->pattern[i];
@@ -713,21 +714,28 @@ ice_hash_parse_raw_pattern(struct ice_adapter *ad,
 			msk_buf[j] = tmp_val * 16 + tmp_c - '0';
 	}
 
-	if (ice_parser_create(&ad->hw, &psr))
-		return -rte_errno;
-	if (ice_parser_run(psr, pkt_buf, pkt_len, &rslt))
-		return -rte_errno;
+	if (ice_parser_create(&ad->hw, &psr)) {
+		ret = -rte_errno;
+		goto exit;
+	}
+	if (ice_parser_run(psr, pkt_buf, pkt_len, &rslt)) {
+		ret = -rte_errno;
+		goto exit;
+	}
 	ice_parser_destroy(psr);
 
 	if (ice_parser_profile_init(&rslt, pkt_buf, msk_buf,
-		pkt_len, ICE_BLK_RSS, true, &prof))
-		return -rte_errno;
+		pkt_len, ICE_BLK_RSS, true, &prof)) {
+		ret = -rte_errno;
+		goto exit;
+	}
 
 	rte_memcpy(&meta->raw.prof, &prof, sizeof(prof));
 
+exit:
 	rte_free(pkt_buf);
 	rte_free(msk_buf);
-	return 0;
+	return ret;
 }
 
 static void
Signature · 1 line
2.25.1
#19 lore raw

Re: [PATCH 13/20] net/ice: fix memory leaks in error handlings

Quoted 6 lines · Weiguo Li
drivers/net/ice/ice_hash.c +0 -2
@@ -713,21 +714,28 @@ ice_hash_parse_raw_pattern(struct ice_adapter *ad,
                        msk_buf[j] = tmp_val * 16 + tmp_c - '0';
        }
 
-       if (ice_parser_create(&ad->hw, &psr))
-               return -rte_errno;

drivers/net/ice/ice_hash.c ice_hash_parse_raw_pattern(struct ice_adapter *ad, · line 724

Quoted 10 lines
drivers/net/ice/ice_hash.c +8 -2
-       if (ice_parser_run(psr, pkt_buf, pkt_len, &rslt))
-               return -rte_errno;
+       if (ice_parser_create(&ad->hw, &psr)) {
+               ret = -rte_errno;
+               goto exit;
+       }
+       if (ice_parser_run(psr, pkt_buf, pkt_len, &rslt)) {
+               ret = -rte_errno;
+               goto exit;
+       }

This part of the patch seems to conflict.
Can you double check and rebase?

Thanks.

Signature · 1 line
David Marchand
author
#20 lore raw

PATCH 14/20 net/ice: avoid fix memory leaks in register parser

In reply to a message not in the archive

1) When 'ice_get_parser_list()' fails and return, 'parser_node' is not released, we can move the parser list action ahead of the memory allocation to avoid this memory leak.
2) In another error handling branch, we release 'parser_node' directly to avoid the memory leak.

Fixes 7615a6895009cb ("net/ice: rework for generic flow enabling")
---
 drivers/net/ice/ice_generic_flow.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/net/ice/ice_generic_flow.c +5 -4
index 53b1c0b69a..e3df090186 100644
@@ -1920,6 +1920,10 @@ ice_register_parser(struct ice_flow_parser *parser,
 	struct ice_flow_parser_node *existing_node;
 	void *temp;
 
+	list = ice_get_parser_list(parser, ad);
+	if (list == NULL)
+		return -EINVAL;
+
 	parser_node = rte_zmalloc("ice_parser", sizeof(*parser_node), 0);
 	if (parser_node == NULL) {
 		PMD_DRV_LOG(ERR, "Failed to allocate memory.");
@@ -1927,10 +1931,6 @@ ice_register_parser(struct ice_flow_parser *parser,
 	}
 	parser_node->parser = parser;
 
-	list = ice_get_parser_list(parser, ad);
-	if (list == NULL)
-		return -EINVAL;
-
 	if (ad->devargs.pipe_mode_support) {
 		TAILQ_INSERT_TAIL(list, parser_node, node);
 	} else {
@@ -1961,6 +1961,7 @@ ice_register_parser(struct ice_flow_parser *parser,
 		} else if (parser->engine->type == ICE_FLOW_ENGINE_ACL) {
 			TAILQ_INSERT_HEAD(list, parser_node, node);
 		} else {
+			rte_free(parser_node);
 			return -EINVAL;
 		}
 	}
Signature · 1 line
2.25.1
author
#21 lore raw

PATCH 15/20 net/memif: fix some memory leaks in error handlings

In reply to a message not in the archive

1) When the validate to 'reply->num_fds' fails, memif_region 'r' is not released, we can move the validation ahead of the memory allocation to avoid this memory leak.
2) In some error handlings, functions were returned without releasing the memory. Fix them altogether in this patch.

Fixes c41a04958b09 ("net/memif: support multi-process")
Fixes 43b815d88188 ("net/memif: support zero-copy slave")
Fixes d61138d4f0e2 ("drivers: remove direct access to interrupt handle")
---
 drivers/net/memif/rte_eth_memif.c | 32 +++++++++++++++++++++----------
 1 file changed, 22 insertions(+), 10 deletions(-)
drivers/net/memif/rte_eth_memif.c +22 -10
index 587ad45576..ddbdeb6241 100644
@@ -158,6 +158,11 @@ memif_mp_request_regions(struct rte_eth_dev *dev)
 		reply_param = (struct mp_region_msg *)reply->param;
 
 		if (reply_param->size > 0) {
+			if (reply->num_fds < 1) {
+				MIF_LOG(ERR, "Missing file descriptor.");
+				free(reply);
+				return -1;
+			}
 			r = rte_zmalloc("region", sizeof(struct memif_region), 0);
 			if (r == NULL) {
 				MIF_LOG(ERR, "Failed to alloc memif region.");
@@ -165,11 +170,6 @@ memif_mp_request_regions(struct rte_eth_dev *dev)
 				return -ENOMEM;
 			}
 			r->region_size = reply_param->size;
-			if (reply->num_fds < 1) {
-				MIF_LOG(ERR, "Missing file descriptor.");
-				free(reply);
-				return -1;
-			}
 			r->fd = reply->fds[0];
 			r->addr = NULL;
 
@@ -913,8 +913,10 @@ memif_region_init_zc(const struct rte_memseg_list *msl, const struct rte_memseg
 		r->addr = msl->base_va;
 		r->region_size = ms->len;
 		r->fd = rte_memseg_get_fd(ms);
-		if (r->fd < 0)
+		if (r->fd < 0) {
+			rte_free(r);
 			return -1;
+		}
 		r->pkt_buffer_offset = 0;
 
 		proc_private->regions[proc_private->regions_num - 1] = r;
@@ -1328,6 +1330,7 @@ memif_tx_queue_setup(struct rte_eth_dev *dev,
 	mq->intr_handle = rte_intr_instance_alloc(RTE_INTR_INSTANCE_F_SHARED);
 	if (mq->intr_handle == NULL) {
 		MIF_LOG(ERR, "Failed to allocate intr handle");
+		rte_free(mq);
 		return -ENOMEM;
 	}
 
@@ -1336,11 +1339,15 @@ memif_tx_queue_setup(struct rte_eth_dev *dev,
 	mq->n_pkts = 0;
 	mq->n_bytes = 0;
 
-	if (rte_intr_fd_set(mq->intr_handle, -1))
+	if (rte_intr_fd_set(mq->intr_handle, -1)) {
+		rte_free(mq);
 		return -rte_errno;
+	}
 
-	if (rte_intr_type_set(mq->intr_handle, RTE_INTR_HANDLE_EXT))
+	if (rte_intr_type_set(mq->intr_handle, RTE_INTR_HANDLE_EXT)) {
+		rte_free(mq);
 		return -rte_errno;
+	}
 
 	mq->in_port = dev->data->port_id;
 	dev->data->tx_queues[qid] = mq;
@@ -1369,6 +1376,7 @@ memif_rx_queue_setup(struct rte_eth_dev *dev,
 	mq->intr_handle = rte_intr_instance_alloc(RTE_INTR_INSTANCE_F_SHARED);
 	if (mq->intr_handle == NULL) {
 		MIF_LOG(ERR, "Failed to allocate intr handle");
+		rte_free(mq);
 		return -ENOMEM;
 	}
 
@@ -1376,11 +1384,15 @@ memif_rx_queue_setup(struct rte_eth_dev *dev,
 	mq->n_pkts = 0;
 	mq->n_bytes = 0;
 
-	if (rte_intr_fd_set(mq->intr_handle, -1))
+	if (rte_intr_fd_set(mq->intr_handle, -1)) {
+		rte_free(mq);
 		return -rte_errno;
+	}
 
-	if (rte_intr_type_set(mq->intr_handle, RTE_INTR_HANDLE_EXT))
+	if (rte_intr_type_set(mq->intr_handle, RTE_INTR_HANDLE_EXT)) {
+		rte_free(mq);
 		return -rte_errno;
+	}
 
 	mq->mempool = mb_pool;
 	mq->in_port = dev->data->port_id;
Signature · 1 line
2.25.1
author
#22 lore raw

PATCH 16/20 net/sfc: fix a memory leak in error handling

In reply to a message not in the archive

When efx_nic_get_board_info() failed then function return, the memory in 'id' is not released, this leads to a memory leak.

Fixes e86b48aa46d4 ("net/sfc: add HW switch ID helpers")
---
 drivers/net/sfc/sfc.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/sfc/sfc.c +3 -1
index 51726d229b..ad1683a512 100644
@@ -1423,8 +1423,10 @@ sfc_hw_switch_id_init(struct sfc_adapter *sa,
 		return ENOMEM;
 
 	rc = efx_nic_get_board_info(sa->nic, &board_info);
-	if (rc != 0)
+	if (rc != 0) {
+		rte_free(id);
 		return rc;
+	}
 
 	memcpy(id->board_sn, board_info.enbi_serial, sizeof(id->board_sn));
 
Signature · 1 line
2.25.1
author
#24 lore raw

PATCH 17/20 net/vmxnet3: fix memory leaks in error handlings

In reply to a message not in the archive

1) in function vmxnet3_dev_tx_queue_setup():
The momory of 'txq' is stored to 'dev->data->tx_queues[queue_idx]' at the end of the function. When function returned early in the error handling, 'txq' is not released which leads to a memory leak.
2) in function vmxnet3_dev_rx_queue_setup():
Same reason to case 1) with memory 'rxq'.

Fixes dfaff37fc46d ("vmxnet3: import new vmxnet3 poll mode driver implementation")
---
 drivers/net/vmxnet3/vmxnet3_rxtx.c | 8 ++++++++
 1 file changed, 8 insertions(+)
drivers/net/vmxnet3/vmxnet3_rxtx.c +8 -0
index d745064bc4..3d1c6080e8 100644
@@ -1057,10 +1057,12 @@ vmxnet3_dev_tx_queue_setup(struct rte_eth_dev *dev,
 
 	/* Tx vmxnet ring length should be between 512-4096 */
 	if (nb_desc < VMXNET3_DEF_TX_RING_SIZE) {
+		rte_free(txq);
 		PMD_INIT_LOG(ERR, "VMXNET3 Tx Ring Size Min: %u",
 			     VMXNET3_DEF_TX_RING_SIZE);
 		return -EINVAL;
 	} else if (nb_desc > VMXNET3_TX_RING_MAX_SIZE) {
+		rte_free(txq);
 		PMD_INIT_LOG(ERR, "VMXNET3 Tx Ring Size Max: %u",
 			     VMXNET3_TX_RING_MAX_SIZE);
 		return -EINVAL;
@@ -1084,6 +1086,7 @@ vmxnet3_dev_tx_queue_setup(struct rte_eth_dev *dev,
 	mz = rte_eth_dma_zone_reserve(dev, "txdesc", queue_idx, size,
 				      VMXNET3_RING_BA_ALIGN, socket_id);
 	if (mz == NULL) {
+		rte_free(txq);
 		PMD_INIT_LOG(ERR, "ERROR: Creating queue descriptors zone");
 		return -ENOMEM;
 	}
@@ -1108,6 +1111,7 @@ vmxnet3_dev_tx_queue_setup(struct rte_eth_dev *dev,
 	ring->buf_info = rte_zmalloc("tx_ring_buf_info",
 				     ring->size * sizeof(vmxnet3_buf_info_t), RTE_CACHE_LINE_SIZE);
 	if (ring->buf_info == NULL) {
+		rte_free(txq);
 		PMD_INIT_LOG(ERR, "ERROR: Creating tx_buf_info structure");
 		return -ENOMEM;
 	}
@@ -1163,9 +1167,11 @@ vmxnet3_dev_rx_queue_setup(struct rte_eth_dev *dev,
 
 	/* Rx vmxnet rings length should be between 256-4096 */
 	if (nb_desc < VMXNET3_DEF_RX_RING_SIZE) {
+		rte_free(rxq);
 		PMD_INIT_LOG(ERR, "VMXNET3 Rx Ring Size Min: 256");
 		return -EINVAL;
 	} else if (nb_desc > VMXNET3_RX_RING_MAX_SIZE) {
+		rte_free(rxq);
 		PMD_INIT_LOG(ERR, "VMXNET3 Rx Ring Size Max: 4096");
 		return -EINVAL;
 	} else {
@@ -1195,6 +1201,7 @@ vmxnet3_dev_rx_queue_setup(struct rte_eth_dev *dev,
 	mz = rte_eth_dma_zone_reserve(dev, "rxdesc", queue_idx, size,
 				      VMXNET3_RING_BA_ALIGN, socket_id);
 	if (mz == NULL) {
+		rte_free(rxq);
 		PMD_INIT_LOG(ERR, "ERROR: Creating queue descriptors zone");
 		return -ENOMEM;
 	}
@@ -1233,6 +1240,7 @@ vmxnet3_dev_rx_queue_setup(struct rte_eth_dev *dev,
 					     ring->size * sizeof(vmxnet3_buf_info_t),
 					     RTE_CACHE_LINE_SIZE);
 		if (ring->buf_info == NULL) {
+			rte_free(rxq);
 			PMD_INIT_LOG(ERR, "ERROR: Creating rx_buf_info structure");
 			return -ENOMEM;
 		}
Signature · 1 line
2.25.1
author
#25 lore raw

PATCH 18/20 raw/ifpga/base: fix memory leaks in error handlings

In reply to a message not in the archive

1) in ifpga_enumerate.c:
The memory 'feature' is stored by TAILQ_INSERT_TAIL() at the end of the function. When function returned early in error handling, 'feature' is not released and leads to a memory leak.

2) in opae_eth_group.c and opae_i2c.c
These function return 'dev' when success and return NULL when validation failed or some error occur. In the latter case 'dev' is not released and leads to a memory leak.

Fixes 56bb54ea1bdf ("raw/ifpga/base: add Intel FPGA OPAE share code")
Fixes 12f92a513a13 ("raw/ifpga/base: fix retimer link status")
Fixes 15d21c851028 ("raw/ifpga/base: add I2C and at24 EEPROM driver")
---
 drivers/raw/ifpga/base/ifpga_enumerate.c | 10 ++++++++--
 drivers/raw/ifpga/base/opae_eth_group.c  |  1 +
 drivers/raw/ifpga/base/opae_i2c.c        |  5 ++++-
 3 files changed, 13 insertions(+), 3 deletions(-)
drivers/raw/ifpga/base/ifpga_enumerate.c +8 -2
index 48b8af4587..ae7bc9326d 100644
@@ -100,12 +100,16 @@ build_info_add_sub_feature(struct build_feature_devs_info *binfo,
 			(unsigned long long)feature->phys_addr, size);
 
 	if (vec_cnt) {
-		if (vec_start + vec_cnt <= vec_start)
+		if (vec_start + vec_cnt <= vec_start) {
+			opae_free(feature);
 			return -EINVAL;
+		}
 
 		ctx = zmalloc(sizeof(*ctx) * vec_cnt);
-		if (!ctx)
+		if (!ctx) {
+			opae_free(feature);
 			return -ENOMEM;
+		}
 
 		for (i = 0; i < vec_cnt; i++) {
 			ctx[i].eventfd = -1;
@@ -130,6 +134,8 @@ build_info_add_sub_feature(struct build_feature_devs_info *binfo,
 		TAILQ_INSERT_TAIL(&hw->port[port_id].feature_list,
 				feature, next);
 	} else {
+		opae_free(feature->ctx);
+		opae_free(feature);
 		return -EFAULT;
 	}
 	return ret;
drivers/raw/ifpga/base/opae_eth_group.c +1 -0
index be28954e05..cd9b2443c7 100644
@@ -297,6 +297,7 @@ struct eth_group_device *eth_group_probe(void *base)
 
 	if (eth_group_hw_init(dev)) {
 		dev_err(dev, "eth group hw init fail\n");
+		opae_free(dev);
 		return NULL;
 	}
 
drivers/raw/ifpga/base/opae_i2c.c +4 -1
index 598eab5742..0a9abff14d 100644
@@ -479,6 +479,7 @@ struct altera_i2c_dev *altera_i2c_probe(void *base)
 
 	if (dev->i2c_param.devid != 0xEE011) {
 		dev_err(dev, "find a invalid i2c master\n");
+		opae_free(dev);
 		return NULL;
 	}
 
@@ -494,8 +495,10 @@ struct altera_i2c_dev *altera_i2c_probe(void *base)
 	dev->i2c_clk = dev->i2c_param.ref_clk * 1000000;
 	dev->xfer = altera_i2c_xfer;
 
-	if (pthread_mutex_init(&dev->lock, NULL))
+	if (pthread_mutex_init(&dev->lock, NULL)) {
+		opae_free(dev);
 		return NULL;
+	}
 	dev->mutex = &dev->lock;
 
 	altera_i2c_hardware_init(dev);
Signature · 1 line
2.25.1
author
#26 lore raw

PATCH 19/20 raw/ntb: fix some memory leaks in error handlings

In reply to a message not in the archive

1) in ntb_rxq_setup():
When 'rxq_conf->rx_mp' validation failed and return, the memory to
'rxq' is leaked. We can move the validation ahead the allocation for 'rxq' to avoid it.
2) in ntb_txq_setup():
The memory 'txq' is stored to 'hw->tx_queues[qp_id]' at the end of the function when successful. When the validation failed then function returned early, 'rxq' is not released which leads to a memory leak.

Fixes c39d1e082a4b ("raw/ntb: setup queues")
---
 drivers/raw/ntb/ntb.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/raw/ntb/ntb.c +5 -4
index f5e773c53b..532c5141f0 100644
@@ -314,6 +314,10 @@ ntb_rxq_setup(struct rte_rawdev *dev,
 	if (conf_size != sizeof(*rxq_conf))
 		return -EINVAL;
 
+	if (rxq_conf->rx_mp == NULL) {
+		NTB_LOG(ERR, "Invalid null mempool pointer.");
+		return -EINVAL;
+	}
 	/* Allocate the rx queue data structure */
 	rxq = rte_zmalloc_socket("ntb rx queue",
 				 sizeof(struct ntb_rx_queue),
@@ -325,10 +329,6 @@ ntb_rxq_setup(struct rte_rawdev *dev,
 		return -ENOMEM;
 	}
 
-	if (rxq_conf->rx_mp == NULL) {
-		NTB_LOG(ERR, "Invalid null mempool pointer.");
-		return -EINVAL;
-	}
 	rxq->nb_rx_desc = rxq_conf->nb_desc;
 	rxq->mpool = rxq_conf->rx_mp;
 	rxq->port_id = dev->dev_id;
@@ -445,6 +445,7 @@ ntb_txq_setup(struct rte_rawdev *dev,
 		NTB_LOG(ERR, "tx_free_thresh must be less than nb_desc - 3. "
 			"(tx_free_thresh=%u qp_id=%u)", txq->tx_free_thresh,
 			qp_id);
+		ntb_txq_release(txq);
 		return -EINVAL;
 	}
 
Signature · 1 line
2.25.1
author
#27 lore raw

PATCH 20/20 regex/mlx5: fix a memory leak in error handling

In reply to a message not in the archive

When rxp_create_mkey() failed the function return, 'ptr' was not freed which caused a memory leak.

Fixes 9fa82d287f65 ("regex/mlx5: move RXP to CrSpace")
---
 drivers/regex/mlx5/mlx5_rxp.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/regex/mlx5/mlx5_rxp.c +3 -1
index ed3af15e40..4da29a2a06 100644
@@ -117,8 +117,10 @@ mlx5_regex_rules_db_import(struct rte_regexdev *dev,
 	rte_memcpy(ptr, rule_db, rule_db_len);
 	/* Register umem and create rof mkey. */
 	ret = rxp_create_mkey(priv, ptr, rule_db_len, /*access=*/7, &mkey);
-	if (ret < 0)
+	if (ret < 0) {
+		rte_free(ptr);
 		return ret;
+	}
 
 	for (id = 0; id < priv->nb_engines; id++) {
 		ret = mlx5_devx_regex_rules_program(priv->cdev->ctx, id,
Signature · 1 line
2.25.1