From 5d138ef92d47b34af589e49f505fb1bf6db5f09b Mon Sep 17 00:00:00 2001 From: Igor Romanov Date: Fri, 14 Sep 2018 08:31:36 +0100 Subject: [PATCH] net/sfc: fix a Tx queue double release possibility There are two function that call sfc_tx_qfini(): sfc_tx_fini_queues() and sfc_tx_queue_release(). But only sfc_tx_queue_release() sets tx_queues pointer of the device data to NULL. It may lead to the scenario in which a queue is destroyed by sfc_tx_fini_queues() and after the queue is attempted to be destroyed again by sfc_tx_queue_release(). Move NULL assignment to sfc_tx_qfini(). Fixes: b1b7ad933b39 ("net/sfc: set up and release Tx queues") Cc: stable@dpdk.org Signed-off-by: Igor Romanov Signed-off-by: Andrew Rybchenko --- drivers/net/sfc/sfc_ethdev.c | 3 --- drivers/net/sfc/sfc_tx.c | 2 ++ 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/net/sfc/sfc_ethdev.c b/drivers/net/sfc/sfc_ethdev.c index 23778c9f38..93bfecc4ee 100644 --- a/drivers/net/sfc/sfc_ethdev.c +++ b/drivers/net/sfc/sfc_ethdev.c @@ -498,9 +498,6 @@ sfc_tx_queue_release(void *queue) sfc_adapter_lock(sa); - SFC_ASSERT(sw_index < sa->eth_dev->data->nb_tx_queues); - sa->eth_dev->data->tx_queues[sw_index] = NULL; - sfc_tx_qfini(sa, sw_index); sfc_adapter_unlock(sa); diff --git a/drivers/net/sfc/sfc_tx.c b/drivers/net/sfc/sfc_tx.c index 8af08b37c3..12665d8134 100644 --- a/drivers/net/sfc/sfc_tx.c +++ b/drivers/net/sfc/sfc_tx.c @@ -233,6 +233,8 @@ sfc_tx_qfini(struct sfc_adapter *sa, unsigned int sw_index) sfc_log_init(sa, "TxQ = %u", sw_index); SFC_ASSERT(sw_index < sa->txq_count); + sa->eth_dev->data->tx_queues[sw_index] = NULL; + txq_info = &sa->txq_info[sw_index]; txq = txq_info->txq; -- 2.20.1