From 94e257ec8ca82a98e38ffb9e7c117a8aac554489 Mon Sep 17 00:00:00 2001 From: Dmitry Kozlyuk Date: Tue, 20 Jul 2021 10:53:35 +0300 Subject: [PATCH] net/mlx5: fix Rx/Tx queue checks When device configuration was interrupted by a signal, mlx5_rxq/txq_release() could access yet unitinialized array and crash the application. Add checks whether queue array is initialized. Fixes: a1366b1a2be3 ("net/mlx5: add reference counter on DPDK Rx queues") Fixes: 6e78005a9b30 ("net/mlx5: add reference counter on DPDK Tx queues") Cc: stable@dpdk.org Signed-off-by: Dmitry Kozlyuk Acked-by: Matan Azrad --- drivers/net/mlx5/mlx5_rxq.c | 2 +- drivers/net/mlx5/mlx5_txq.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/mlx5/mlx5_rxq.c b/drivers/net/mlx5/mlx5_rxq.c index dacffc9251..4a8b67e731 100644 --- a/drivers/net/mlx5/mlx5_rxq.c +++ b/drivers/net/mlx5/mlx5_rxq.c @@ -1712,7 +1712,7 @@ mlx5_rxq_release(struct rte_eth_dev *dev, uint16_t idx) struct mlx5_priv *priv = dev->data->dev_private; struct mlx5_rxq_ctrl *rxq_ctrl; - if (!(*priv->rxqs)[idx]) + if (priv->rxqs == NULL || (*priv->rxqs)[idx] == NULL) return 0; rxq_ctrl = container_of((*priv->rxqs)[idx], struct mlx5_rxq_ctrl, rxq); if (__atomic_sub_fetch(&rxq_ctrl->refcnt, 1, __ATOMIC_RELAXED) > 1) diff --git a/drivers/net/mlx5/mlx5_txq.c b/drivers/net/mlx5/mlx5_txq.c index f68c0c61a9..eb4d34ca55 100644 --- a/drivers/net/mlx5/mlx5_txq.c +++ b/drivers/net/mlx5/mlx5_txq.c @@ -1246,7 +1246,7 @@ mlx5_txq_release(struct rte_eth_dev *dev, uint16_t idx) struct mlx5_priv *priv = dev->data->dev_private; struct mlx5_txq_ctrl *txq_ctrl; - if (!(*priv->txqs)[idx]) + if (priv->txqs == NULL || (*priv->txqs)[idx] == NULL) return 0; txq_ctrl = container_of((*priv->txqs)[idx], struct mlx5_txq_ctrl, txq); if (__atomic_sub_fetch(&txq_ctrl->refcnt, 1, __ATOMIC_RELAXED) > 1) -- 2.20.1