[dpdk-stable] patch 'net/bnxt: fix double free in port start failure' has been queued to stable release 20.11.2

[Xueming Li]

Hi,

FYI, your patch has been queued to stable release 20.11.2

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 05/12/21. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/steevenlee/dpdk

This queued commit can be viewed at:
https://github.com/steevenlee/dpdk/commit/bc53c25124f8af291c79cb315c95fad9202b8963

Thanks.

Xueming Li <xuemingl at nvidia.com>

---
>From bc53c25124f8af291c79cb315c95fad9202b8963 Mon Sep 17 00:00:00 2001
From: Kalesh AP <kalesh-anakkur.purayil at broadcom.com>
Date: Thu, 1 Apr 2021 08:23:34 +0530
Subject: [PATCH] net/bnxt: fix double free in port start failure
Cc: Luca Boccassi <bluca at debian.org>

[ upstream commit 39a03b401e4a72a118bae60c5834be2b6913098e ]

During port start when bnxt_start_nic() fails, it tries to free
"intr_handle->intr_vec" but the variable is not set to NULL after that.
If port start fails, driver invokes bnxt_dev_stop() which will lead
to a double free of "intr_handle->intr_vec".

Fix it by removing the call to free "intr_handle->intr_vec" in the
bnxt_start_nic() failure path as it is anyway doing in bnxt_dev_stop().

Fixes: 9d276b439aaf ("net/bnxt: fix error handling in device start")

Signed-off-by: Kalesh AP <kalesh-anakkur.purayil at broadcom.com>
Reviewed-by: Somnath Kotur <somnath.kotur at broadcom.com>
Reviewed-by: Ajit Khaparde <ajit.khaparde at broadcom.com>
---
 drivers/net/bnxt/bnxt_ethdev.c | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/drivers/net/bnxt/bnxt_ethdev.c b/drivers/net/bnxt/bnxt_ethdev.c
index 85c711b71f..e5fe1a687c 100644
--- a/drivers/net/bnxt/bnxt_ethdev.c
+++ b/drivers/net/bnxt/bnxt_ethdev.c
@@ -797,7 +797,7 @@ skip_cosq_cfg:
 			PMD_DRV_LOG(ERR, "Failed to allocate %d rx_queues"
 				" intr_vec", bp->eth_dev->data->nb_rx_queues);
 			rc = -ENOMEM;
-			goto err_disable;
+			goto err_out;
 		}
 		PMD_DRV_LOG(DEBUG, "intr_handle->intr_vec = %p "
 			"intr_handle->nb_efd = %d intr_handle->max_intr = %d\n",
@@ -817,12 +817,12 @@ skip_cosq_cfg:
 #ifndef RTE_EXEC_ENV_FREEBSD
 	/* In FreeBSD OS, nic_uio driver does not support interrupts */
 	if (rc)
-		goto err_free;
+		goto err_out;
 #endif
 
 	rc = bnxt_update_phy_setting(bp);
 	if (rc)
-		goto err_free;
+		goto err_out;
 
 	bp->mark_table = rte_zmalloc("bnxt_mark_table", BNXT_MARK_TABLE_SZ, 0);
 	if (!bp->mark_table)
@@ -830,10 +830,6 @@ skip_cosq_cfg:
 
 	return 0;
 
-err_free:
-	rte_free(intr_handle->intr_vec);
-err_disable:
-	rte_intr_efd_disable(intr_handle);
 err_out:
 	/* Some of the error status returned by FW may not be from errno.h */
 	if (rc > 0)
-- 
2.25.1

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2021-05-10 23:59:30.408784000 +0800
+++ 0148-net-bnxt-fix-double-free-in-port-start-failure.patch	2021-05-10 23:59:26.570000000 +0800
@@ -1 +1 @@
-From 39a03b401e4a72a118bae60c5834be2b6913098e Mon Sep 17 00:00:00 2001
+From bc53c25124f8af291c79cb315c95fad9202b8963 Mon Sep 17 00:00:00 2001
@@ -4,0 +5,3 @@
+Cc: Luca Boccassi <bluca at debian.org>
+
+[ upstream commit 39a03b401e4a72a118bae60c5834be2b6913098e ]
@@ -15 +17,0 @@
-Cc: stable at dpdk.org
@@ -25 +27 @@
-index d346f96d7a..02fe00036b 100644
+index 85c711b71f..e5fe1a687c 100644
@@ -28 +30 @@
-@@ -793,7 +793,7 @@ skip_cosq_cfg:
+@@ -797,7 +797,7 @@ skip_cosq_cfg:
@@ -37 +39 @@
-@@ -813,12 +813,12 @@ skip_cosq_cfg:
+@@ -817,12 +817,12 @@ skip_cosq_cfg:
@@ -52 +54 @@
-@@ -826,10 +826,6 @@ skip_cosq_cfg:
+@@ -830,10 +830,6 @@ skip_cosq_cfg: