From 7eb7588c99ab5fd0f31032b29cac74b57e1de2ff Mon Sep 17 00:00:00 2001 From: Igor Romanov Date: Fri, 14 Sep 2018 08:31:35 +0100 Subject: [PATCH] net/sfc: fix an Rx queue double release possibility There are two function that call sfc_rx_qfini(): sfc_rx_fini_queues() and sfc_rx_queue_release(). But only sfc_rx_queue_release() sets rx_queues pointer of the device data to NULL. It may lead to the scenario in which a queue is destroyed by sfc_rx_fini_queues() and after the queue is attempted to be destroyed again by sfc_rx_queue_release(). Move NULL assignment to sfc_rx_qfini(). Fixes: ce35b05c635e ("net/sfc: implement Rx queue setup release operations") Cc: stable@dpdk.org Signed-off-by: Igor Romanov Signed-off-by: Andrew Rybchenko --- drivers/net/sfc/sfc_ethdev.c | 2 -- drivers/net/sfc/sfc_rx.c | 1 + 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/net/sfc/sfc_ethdev.c b/drivers/net/sfc/sfc_ethdev.c index 435bde67ff..23778c9f38 100644 --- a/drivers/net/sfc/sfc_ethdev.c +++ b/drivers/net/sfc/sfc_ethdev.c @@ -444,8 +444,6 @@ sfc_rx_queue_release(void *queue) sfc_log_init(sa, "RxQ=%u", sw_index); - sa->eth_dev->data->rx_queues[sw_index] = NULL; - sfc_rx_qfini(sa, sw_index); sfc_adapter_unlock(sa); diff --git a/drivers/net/sfc/sfc_rx.c b/drivers/net/sfc/sfc_rx.c index 338184dda0..58c57acfee 100644 --- a/drivers/net/sfc/sfc_rx.c +++ b/drivers/net/sfc/sfc_rx.c @@ -1103,6 +1103,7 @@ sfc_rx_qfini(struct sfc_adapter *sa, unsigned int sw_index) struct sfc_rxq *rxq; SFC_ASSERT(sw_index < sa->rxq_count); + sa->eth_dev->data->rx_queues[sw_index] = NULL; rxq_info = &sa->rxq_info[sw_index]; -- 2.20.1