From mboxrd@z Thu Jan 1 00:00:00 1970 From: Stephen Hemminger Subject: [PATCH v2 1/2] netvsc: fix rte malloc pool corruption Date: Mon, 13 Aug 2018 08:51:07 -0700 Message-ID: <20180813155108.6460-2-stephen@networkplumber.org> References: <20180813155108.6460-1-stephen@networkplumber.org> Cc: Stephen Hemminger , Stephen Hemminger To: dev@dpdk.org Return-path: Received: from mail-pl0-f66.google.com (mail-pl0-f66.google.com [209.85.160.66]) by dpdk.org (Postfix) with ESMTP id AD04CFEB for ; Mon, 13 Aug 2018 17:51:18 +0200 (CEST) Received: by mail-pl0-f66.google.com with SMTP id t17-v6so7037864ply.13 for ; Mon, 13 Aug 2018 08:51:18 -0700 (PDT) In-Reply-To: <20180813155108.6460-1-stephen@networkplumber.org> List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" The event buffer was changed to be a fixed size value, but calls to rte_free were left. That causes bugs because it calls to rte_free() for a pointer that was not setup with rte_malloc(). Fixes: 530af95a7849 ("bus/vmbus: avoid signalling host on read") Signed-off-by: Stephen Hemminger --- drivers/net/netvsc/hn_rxtx.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/drivers/net/netvsc/hn_rxtx.c b/drivers/net/netvsc/hn_rxtx.c index 02ef27e363cc..3e52a328b152 100644 --- a/drivers/net/netvsc/hn_rxtx.c +++ b/drivers/net/netvsc/hn_rxtx.c @@ -776,7 +776,6 @@ hn_dev_rx_queue_setup(struct rte_eth_dev *dev, fail: rte_ring_free(rxq->rx_ring); - rte_free(rxq->event_buf); rte_free(rxq); return -ENOMEM; } @@ -795,10 +794,8 @@ hn_dev_rx_queue_release(void *arg) rxq->rx_ring = NULL; rxq->mb_pool = NULL; - if (rxq != rxq->hv->primary) { - rte_free(rxq->event_buf); + if (rxq != rxq->hv->primary) rte_free(rxq); - } } void -- 2.18.0