1) in ntb_rxq_setup():
   When 'rxq_conf->rx_mp' validation failed and return, the memory to
  'rxq' is leaked. We can move the validation ahead the allocation for
  'rxq' to avoid it.
2) in ntb_txq_setup():
   The memory 'txq' is stored to 'hw->tx_queues[qp_id]' at the end of
   the function when successful. When the validation failed then function
   returned early, 'rxq' is not released which leads to a memory leak.

Fixes: c39d1e082a4b ("raw/ntb: setup queues")

Signed-off-by: Weiguo Li <liw...@foxmail.com>
---
 drivers/raw/ntb/ntb.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/raw/ntb/ntb.c b/drivers/raw/ntb/ntb.c
index f5e773c53b..532c5141f0 100644
--- a/drivers/raw/ntb/ntb.c
+++ b/drivers/raw/ntb/ntb.c
@@ -314,6 +314,10 @@ ntb_rxq_setup(struct rte_rawdev *dev,
        if (conf_size != sizeof(*rxq_conf))
                return -EINVAL;
 
+       if (rxq_conf->rx_mp == NULL) {
+               NTB_LOG(ERR, "Invalid null mempool pointer.");
+               return -EINVAL;
+       }
        /* Allocate the rx queue data structure */
        rxq = rte_zmalloc_socket("ntb rx queue",
                                 sizeof(struct ntb_rx_queue),
@@ -325,10 +329,6 @@ ntb_rxq_setup(struct rte_rawdev *dev,
                return -ENOMEM;
        }
 
-       if (rxq_conf->rx_mp == NULL) {
-               NTB_LOG(ERR, "Invalid null mempool pointer.");
-               return -EINVAL;
-       }
        rxq->nb_rx_desc = rxq_conf->nb_desc;
        rxq->mpool = rxq_conf->rx_mp;
        rxq->port_id = dev->dev_id;
@@ -445,6 +445,7 @@ ntb_txq_setup(struct rte_rawdev *dev,
                NTB_LOG(ERR, "tx_free_thresh must be less than nb_desc - 3. "
                        "(tx_free_thresh=%u qp_id=%u)", txq->tx_free_thresh,
                        qp_id);
+               ntb_txq_release(txq);
                return -EINVAL;
        }
 
-- 
2.25.1

Reply via email to