Re: [PATCH 1/3] net/iavf: fix invalid free of queue TC map

[Bruce Richardson <bruce.richardson@intel.com>]

On Wed, Oct 14, 2026 at 12:24:16PM +0000, Dawid Wesierski wrote:
> iavf_hierarchy_commit() allocates the queue TC map with calloc(), and
> it frees the previous map with free(old_qtc_map) after a successful
> commit. A later change added rte_free(vf->qtc_map) in front of that
> free(), because it was written for a tree that still leaked the map.
> 
> After the first commit, rte_free() gets a pointer from the libc
> heap, and free() then releases the same pointer a second time.
> rte_free() reads a malloc_elem header in the bytes in front of the
> pointer. It usually logs "Invalid memory" and returns, but the result
> depends on the contents of the libc heap.
> 
> Remove the rte_free() call. free(old_qtc_map) releases the old map.
> 
> Fixes: f6e33f09f766 ("net/iavf: disable runtime queue setup when rate limiting")
> 
> Signed-off-by: Dawid Wesierski <dawid.wesierski@intel.com>
> ---
Acked-by: Bruce Richardson <bruce.richardson@intel.com>
>  drivers/net/intel/iavf/iavf_tm.c | 1 -
>  1 file changed, 1 deletion(-)
> 
> diff --git a/drivers/net/intel/iavf/iavf_tm.c b/drivers/net/intel/iavf/iavf_tm.c
> index fc84bf7e6b..603da09bb5 100644
> --- a/drivers/net/intel/iavf/iavf_tm.c
> +++ b/drivers/net/intel/iavf/iavf_tm.c
> @@ -913,7 +913,6 @@ static int iavf_hierarchy_commit(struct rte_eth_dev *dev,
>  		goto fail_clear;
>  
>  	/* replace the previously committed mapping, if any */
> -	rte_free(vf->qtc_map);
>  	vf->qtc_map = qtc_map;
>  	free(old_qtc_map);
>  	if (adapter->stopped == 1)
> -- 
> 2.43.0
>