[Bug 1199] mlx5: segmentation fault with rte_flow_configure function

[bugzilla at dpdk.org]

https://bugs.dpdk.org/show_bug.cgi?id=1199

            Bug ID: 1199
           Summary: mlx5: segmentation fault with rte_flow_configure
                    function
           Product: DPDK
           Version: 23.03
          Hardware: All
                OS: All
            Status: UNCONFIRMED
          Severity: major
          Priority: Normal
         Component: ethdev
          Assignee: dev at dpdk.org
          Reporter: ccm at ccm.ink
  Target Milestone: ---

I encountered a segmentation fault when attempting to configure queues for the
asynchronous version of rte_flow using the DPDK rte_flow_configure function and
assigning varying sizes to each queue.

Just like this:
  const struct rte_flow_queue_attr *queue_attr[2];
  struct rte_flow_queue_attr setup_queue_attr = {.size = 32};
  struct rte_flow_queue_attr normal_queue_attr = {.size = 100};
  queue_attr[0] = &setup_queue_attr;
  queue_attr[1] = &normal_queue_attr;
  rte_flow_configure(port_id, &port_attr, 2, queue_attr, &err);


Upon reviewing the source code, I discovered that an attempt was made to free
an unallocated memory, which could potentially result in a segmentation
fault(line 7470).

[mlx5_flow_hw.c]
7226 if (_queue_attr[i]->size != _queue_attr[0]->size) {
        rte_errno = EINVAL;
        goto err;
7229 }
...
7239    priv->hw_q = mlx5_malloc(MLX5_MEM_ZERO, mem_size,
7240                             64, SOCKET_ID_ANY);
...
7444  err:
...
7469    for (i = 0; i < nb_q_updated; i++) {
7470            rte_ring_free(priv->hw_q[i].indir_iq);
                rte_ring_free(priv->hw_q[i].indir_cq);
        }
7473    mlx5_free(priv->hw_q);

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mails.dpdk.org/archives/dev/attachments/20230324/894e494e/attachment.htm>