[PATCH] net/bnxt: fix free of not allocated object

Stephen Hemminger stephen at networkplumber.org
Wed May 21 21:37:27 CEST 2025


This was found as error when compiling with LTO.
The function allocates new data with rte_zmalloc and then
stores pointer in the pointer-to-pointer passed as argument.
In the unwind case, it would call rte_free() with wrong one.

Fixes: 80317ff6adfd ("net/bnxt/tf_core: support Thor2")

Signed-off-by: Stephen Hemminger <stephen at networkplumber.org>
---
 drivers/net/bnxt/tf_core/v3/tfo.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/drivers/net/bnxt/tf_core/v3/tfo.c b/drivers/net/bnxt/tf_core/v3/tfo.c
index bee813ebf6..c888dd1e4e 100644
--- a/drivers/net/bnxt/tf_core/v3/tfo.c
+++ b/drivers/net/bnxt/tf_core/v3/tfo.c
@@ -74,9 +74,7 @@ void tfo_open(void **tfo, bool is_pf)
 	rc = cfa_bld_mpc_bind(CFA_P70, &tfco->mpc_info);
 	if (rc) {
 		PMD_DRV_LOG_LINE(ERR, "MPC bind failed");
-		rte_free(tfco);
-		*tfo = NULL;
-		return;
+		goto cleanup;
 	}
 	if (is_pf) {
 		/* Allocate TIM */
@@ -104,8 +102,8 @@ void tfo_open(void **tfo, bool is_pf)
 	return;
 
  cleanup:
-	if (tfco != NULL)
-		rte_free(tfo);
+	rte_free(tfco);
+	*tfo = NULL;
 }
 
 void tfo_close(void **tfo)
-- 
2.47.2



More information about the dev mailing list