From 0ad12a8090d4f34b0308cdbb4cd34750f841d7f9 Mon Sep 17 00:00:00 2001 From: Michael Baum Date: Mon, 14 Feb 2022 11:00:09 +0200 Subject: [PATCH] net/mlx5: fix entry in shared Rx queues list The mlx5_rxq_new function creates control structure and if it from shared group, it is inserted into the shared RXQs list. After that, there are some validations which in case they fail, RxQ control object is released. In these cases, invalid pointer to the object still in the list, and access it may cause a crash. Move the list insertion to the end of the function where the RxQ control object is surely valid. Fixes: 09c2555303be ("net/mlx5: support shared Rx queue") Cc: stable@dpdk.org Signed-off-by: Michael Baum Acked-by: Viacheslav Ovsiienko --- drivers/net/mlx5/mlx5_rxq.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/drivers/net/mlx5/mlx5_rxq.c b/drivers/net/mlx5/mlx5_rxq.c index 2625fa3308..d1476b4115 100644 --- a/drivers/net/mlx5/mlx5_rxq.c +++ b/drivers/net/mlx5/mlx5_rxq.c @@ -1720,12 +1720,6 @@ mlx5_rxq_new(struct rte_eth_dev *dev, struct mlx5_rxq_priv *rxq, return NULL; } LIST_INIT(&tmpl->owners); - if (conf->share_group > 0) { - tmpl->rxq.shared = 1; - tmpl->share_group = conf->share_group; - tmpl->share_qid = conf->share_qid; - LIST_INSERT_HEAD(&priv->sh->shared_rxqs, tmpl, share_entry); - } rxq->ctrl = tmpl; LIST_INSERT_HEAD(&tmpl->owners, rxq, owner_entry); MLX5_ASSERT(n_seg && n_seg <= MLX5_MAX_RXQ_NSEG); @@ -1934,6 +1928,12 @@ mlx5_rxq_new(struct rte_eth_dev *dev, struct mlx5_rxq_priv *rxq, tmpl->rxq.mprq_bufs = (struct mlx5_mprq_buf *(*)[desc])(*tmpl->rxq.elts + desc_n); tmpl->rxq.idx = idx; + if (conf->share_group > 0) { + tmpl->rxq.shared = 1; + tmpl->share_group = conf->share_group; + tmpl->share_qid = conf->share_qid; + LIST_INSERT_HEAD(&priv->sh->shared_rxqs, tmpl, share_entry); + } LIST_INSERT_HEAD(&priv->rxqsctrl, tmpl, next); return tmpl; error: -- 2.39.5