[dpdk-dev] [PATCH] net/mlx5: fix memory free on queue create error

[Dekel Peled]

In function mlx5_rxq_ibv_new(), pointer *tmpl allocation is attempted
at the start, but not validated or freed in case of error.
In function mlx5_txq_ibv_new(), pointer *txq_ibv allocation is
attempted at the start, but not freed in case of error.

This patch adds pointers initialization, validation and freeing.

Fixes: 09cb5b581762 ("net/mlx5: separate DPDK from verbs Rx queue objects")
Fixes: faf2667fe8d5 ("net/mlx5: separate DPDK from verbs Tx queue objects")
Cc: sta...@dpdk.org

Signed-off-by: Dekel Peled <dek...@mellanox.com>
---
 drivers/net/mlx5/mlx5_rxq.c | 22 +++++++++++++---------
 drivers/net/mlx5/mlx5_txq.c |  4 +++-
 2 files changed, 16 insertions(+), 10 deletions(-)

diff --git a/drivers/net/mlx5/mlx5_rxq.c b/drivers/net/mlx5/mlx5_rxq.c
index a00cb12..8cd6157 100644
--- a/drivers/net/mlx5/mlx5_rxq.c
+++ b/drivers/net/mlx5/mlx5_rxq.c
@@ -776,7 +776,7 @@ struct mlx5_rxq_ibv *
        } attr;
        unsigned int cqe_n;
        unsigned int wqe_n = 1 << rxq_data->elts_n;
-       struct mlx5_rxq_ibv *tmpl;
+       struct mlx5_rxq_ibv *tmpl = NULL;
        struct mlx5dv_cq cq_info;
        struct mlx5dv_rwq rwq;
        unsigned int i;
@@ -1017,15 +1017,19 @@ struct mlx5_rxq_ibv *
        priv->verbs_alloc_ctx.type = MLX5_VERBS_ALLOC_TYPE_NONE;
        return tmpl;
 error:
-       ret = rte_errno; /* Save rte_errno before cleanup. */
-       if (tmpl->wq)
-               claim_zero(mlx5_glue->destroy_wq(tmpl->wq));
-       if (tmpl->cq)
-               claim_zero(mlx5_glue->destroy_cq(tmpl->cq));
-       if (tmpl->channel)
-               claim_zero(mlx5_glue->destroy_comp_channel(tmpl->channel));
+       if (tmpl) {
+               ret = rte_errno; /* Save rte_errno before cleanup. */
+               if (tmpl->wq)
+                       claim_zero(mlx5_glue->destroy_wq(tmpl->wq));
+               if (tmpl->cq)
+                       claim_zero(mlx5_glue->destroy_cq(tmpl->cq));
+               if (tmpl->channel)
+                       claim_zero(mlx5_glue->destroy_comp_channel
+                                                       (tmpl->channel));
+               rte_free(tmpl);
+               rte_errno = ret; /* Restore rte_errno. */
+       }
        priv->verbs_alloc_ctx.type = MLX5_VERBS_ALLOC_TYPE_NONE;
-       rte_errno = ret; /* Restore rte_errno. */
        return NULL;
 }
 
diff --git a/drivers/net/mlx5/mlx5_txq.c b/drivers/net/mlx5/mlx5_txq.c
index b281c45..9efbab6 100644
--- a/drivers/net/mlx5/mlx5_txq.c
+++ b/drivers/net/mlx5/mlx5_txq.c
@@ -401,7 +401,7 @@ struct mlx5_txq_ibv *
        struct mlx5_txq_ctrl *txq_ctrl =
                container_of(txq_data, struct mlx5_txq_ctrl, txq);
        struct mlx5_txq_ibv tmpl;
-       struct mlx5_txq_ibv *txq_ibv;
+       struct mlx5_txq_ibv *txq_ibv = NULL;
        union {
                struct ibv_qp_init_attr_ex init;
                struct ibv_cq_init_attr_ex cq;
@@ -586,6 +586,8 @@ struct mlx5_txq_ibv *
                claim_zero(mlx5_glue->destroy_cq(tmpl.cq));
        if (tmpl.qp)
                claim_zero(mlx5_glue->destroy_qp(tmpl.qp));
+       if (txq_ibv)
+               rte_free(txq_ibv);
        priv->verbs_alloc_ctx.type = MLX5_VERBS_ALLOC_TYPE_NONE;
        rte_errno = ret; /* Restore rte_errno. */
        return NULL;
-- 
1.8.3.1