Re: [PATCH 1/3] net/iavf: fix invalid free of queue TC map

[Bruce Richardson <bruce.richardson@intel.com>]

On Mon, Oct 19, 2026 at 05:47:16PM +0100, Bruce Richardson wrote:
> On Wed, Oct 14, 2026 at 12:24:16PM +0000, Dawid Wesierski wrote:
> > iavf_hierarchy_commit() allocates the queue TC map with calloc(), and
> > it frees the previous map with free(old_qtc_map) after a successful
> > commit. A later change added rte_free(vf->qtc_map) in front of that
> > free(), because it was written for a tree that still leaked the map.
> > 
> > After the first commit, rte_free() gets a pointer from the libc
> > heap, and free() then releases the same pointer a second time.
> > rte_free() reads a malloc_elem header in the bytes in front of the
> > pointer. It usually logs "Invalid memory" and returns, but the result
> > depends on the contents of the libc heap.
> > 
> > Remove the rte_free() call. free(old_qtc_map) releases the old map.
> > 
> > Fixes: f6e33f09f766 ("net/iavf: disable runtime queue setup when rate limiting")

AI review flags the fact that this commit also introduces an erroneous
rte_free call in iavf_uninit_vf() in iavf_ethdev.c. While the call is
harmless (and earler free is done and the pointer is set to NULL making
rte_free a no-op) it would be good to remove that too.

> > 
> > Signed-off-by: Dawid Wesierski <dawid.wesierski@intel.com>
> > ---
> Acked-by: Bruce Richardson <bruce.richardson@intel.com>
> >  drivers/net/intel/iavf/iavf_tm.c | 1 -
> >  1 file changed, 1 deletion(-)
> > 
> > diff --git a/drivers/net/intel/iavf/iavf_tm.c b/drivers/net/intel/iavf/iavf_tm.c
> > index fc84bf7e6b..603da09bb5 100644
> > --- a/drivers/net/intel/iavf/iavf_tm.c
> > +++ b/drivers/net/intel/iavf/iavf_tm.c
> > @@ -913,7 +913,6 @@ static int iavf_hierarchy_commit(struct rte_eth_dev *dev,
> >  		goto fail_clear;
> >  
> >  	/* replace the previously committed mapping, if any */
> > -	rte_free(vf->qtc_map);
> >  	vf->qtc_map = qtc_map;
> >  	free(old_qtc_map);
> >  	if (adapter->stopped == 1)
> > -- 
> > 2.43.0
> >