From 4623c0d4b572e9bea28d59e6e54ae6d5dab2412e Mon Sep 17 00:00:00 2001 From: Ajit Khaparde Date: Wed, 25 Jul 2018 18:15:46 -0700 Subject: [PATCH] net/bnxt: fix lock release on NVM write failure In bnxt_hwrm_flash_nvram, before attempting to allocate a buffer we are grabbing the rte_spinlock. And if the allocation fails we are returning before releasing the spinlock. We avoid the situation by calling HWRM_PREP which grabs the lock after the buffer is allocated successfully. Fixes: 19e6af01bb36 ("net/bnxt: support get/set EEPROM") Cc: stable@dpdk.org Signed-off-by: Ajit Khaparde Reviewed-by: Randy Schacher --- drivers/net/bnxt/bnxt_hwrm.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/drivers/net/bnxt/bnxt_hwrm.c b/drivers/net/bnxt/bnxt_hwrm.c index 3f8e26ca3d..5e8970ac3b 100644 --- a/drivers/net/bnxt/bnxt_hwrm.c +++ b/drivers/net/bnxt/bnxt_hwrm.c @@ -3427,14 +3427,6 @@ int bnxt_hwrm_flash_nvram(struct bnxt *bp, uint16_t dir_type, rte_iova_t dma_handle; uint8_t *buf; - HWRM_PREP(req, NVM_WRITE); - - req.dir_type = rte_cpu_to_le_16(dir_type); - req.dir_ordinal = rte_cpu_to_le_16(dir_ordinal); - req.dir_ext = rte_cpu_to_le_16(dir_ext); - req.dir_attr = rte_cpu_to_le_16(dir_attr); - req.dir_data_length = rte_cpu_to_le_32(data_len); - buf = rte_malloc("nvm_write", data_len, 0); rte_mem_lock_page(buf); if (!buf) @@ -3447,6 +3439,14 @@ int bnxt_hwrm_flash_nvram(struct bnxt *bp, uint16_t dir_type, return -ENOMEM; } memcpy(buf, data, data_len); + + HWRM_PREP(req, NVM_WRITE); + + req.dir_type = rte_cpu_to_le_16(dir_type); + req.dir_ordinal = rte_cpu_to_le_16(dir_ordinal); + req.dir_ext = rte_cpu_to_le_16(dir_ext); + req.dir_attr = rte_cpu_to_le_16(dir_attr); + req.dir_data_length = rte_cpu_to_le_32(data_len); req.host_src_addr = rte_cpu_to_le_64(dma_handle); rc = bnxt_hwrm_send_message(bp, &req, sizeof(req)); -- 2.20.1