Currently, when a TM node is added with a shaper profile assigned,
the profile's reference count is not incremented. Equally, when a node
is deleted, the count is not decremented. As a result, the guard that
blocks deletion of an in-use profile never triggers, allowing the profile
to be freed while nodes still hold a pointer to it.
Fix by maintaining the reference count correctly when nodes take or
release a shaper profile, so that deletion of an in-use profile is
properly rejected.
Fixes: 8c481c3bb65b ("net/ice: support queue and queue group bandwidth limit")
Cc: [email protected]
Signed-off-by: Ciara Loftus <[email protected]>
Acked-by: Bruce Richardson <[email protected]>
---
drivers/net/intel/ice/ice_tm.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/net/intel/ice/ice_tm.c b/drivers/net/intel/ice/ice_tm.c
index 2bb684bb02..015a827d7a 100644
--- a/drivers/net/intel/ice/ice_tm.c
+++ b/drivers/net/intel/ice/ice_tm.c
@@ -456,6 +456,8 @@ ice_tm_node_add(struct rte_eth_dev *dev, uint32_t node_id,
tm_node->parent = NULL;
tm_node->reference_count = 0;
tm_node->shaper_profile = shaper_profile;
+ if (shaper_profile != NULL)
+ shaper_profile->reference_count++;
tm_node->children = RTE_PTR_ADD(tm_node, sizeof(struct
ice_tm_node));
tm_node->params = *params;
pf->tm_conf.root = tm_node;
@@ -518,6 +520,8 @@ ice_tm_node_add(struct rte_eth_dev *dev, uint32_t node_id,
tm_node->parent = parent_node;
tm_node->level = level_id;
tm_node->shaper_profile = shaper_profile;
+ if (shaper_profile != NULL)
+ shaper_profile->reference_count++;
tm_node->children = RTE_PTR_ADD(tm_node, sizeof(struct ice_tm_node));
tm_node->parent->children[tm_node->parent->reference_count++] = tm_node;
tm_node->params = *params;
@@ -568,6 +572,8 @@ ice_tm_node_delete(struct rte_eth_dev *dev, uint32_t
node_id,
/* root node */
if (tm_node->level == 0) {
+ if (tm_node->shaper_profile != NULL)
+ tm_node->shaper_profile->reference_count--;
rte_free(tm_node);
pf->tm_conf.root = NULL;
return 0;
@@ -582,6 +588,8 @@ ice_tm_node_delete(struct rte_eth_dev *dev, uint32_t
node_id,
tm_node->parent->children[j] = tm_node->parent->children[j + 1];
tm_node->parent->reference_count--;
+ if (tm_node->shaper_profile != NULL)
+ tm_node->shaper_profile->reference_count--;
rte_free(tm_node);
return 0;
--
2.43.0
