[PATCH v2] net/netvsc: fix event buffer leak on realloc failure

[Chen Zhao]

rte_realloc() failure overwrites event_buf and leaks the old allocation.
Use a temporary pointer and update event_buf and event_sz only on success,
preserving the existing buffer and size on failure.

Fixes: 1f2766b7ee02 ("net/netvsc: resize event buffer as needed")
Cc: stable at dpdk.org
Signed-off-by: Chen Zhao <ch3nzhao at gmail.com>
---
v2:
- Preserve the existing buffer and size on allocation failure.
- Update the buffer pointer and size only on success.
- Remove the obsolete Microsoft email address.

 .mailmap                     |  1 +
 drivers/net/netvsc/hn_rxtx.c | 18 ++++++++++--------
 2 files changed, 11 insertions(+), 8 deletions(-)

diff --git a/.mailmap b/.mailmap
index 6d9e262cfb..deae6514dd 100644
--- a/.mailmap
+++ b/.mailmap
@@ -267,6 +267,7 @@ Charles Myers <charles.myers at spirent.com>
 Charles Stoll <charles.stoll at intel.com>
 Chas Williams <3chas3 at gmail.com> <chas3 at att.com>
 Chas Williams <3chas3 at gmail.com> <ciwillia at brocade.com>
+Chen Zhao <ch3nzhao at gmail.com>
 Chenbo Xia <chenbox at nvidia.com> <chenbo.xia at intel.com>
 Cheng Jiang <honest.jiang at foxmail.com> <cheng1.jiang at intel.com>
 Cheng Liu <liucheng11 at huawei.com>
diff --git a/drivers/net/netvsc/hn_rxtx.c b/drivers/net/netvsc/hn_rxtx.c
index 6f536610f2..f38fc33f7c 100644
--- a/drivers/net/netvsc/hn_rxtx.c
+++ b/drivers/net/netvsc/hn_rxtx.c
@@ -1131,17 +1131,19 @@ uint32_t hn_process_events(struct hn_data *hv, uint16_t queue_id,
 
 		if (unlikely(ret == -ENOBUFS)) {
 			/* event buffer not large enough to read ring */
+			uint32_t new_sz = len + len / 4;
+			void *new_buf;
 
 			PMD_DRV_LOG(DEBUG,
 				    "event buffer expansion (need %u)", len);
-			rxq->event_sz = len + len / 4;
-			rxq->event_buf = rte_realloc(rxq->event_buf, rxq->event_sz,
-						     RTE_CACHE_LINE_SIZE);
-			if (rxq->event_buf)
-				goto retry;
-			/* out of memory, no more events now */
-			rxq->event_sz = 0;
-			break;
+			new_buf = rte_realloc(rxq->event_buf, new_sz,
+					      RTE_CACHE_LINE_SIZE);
+			if (new_buf == NULL)
+				break;	/* out of memory, no more events now */
+
+			rxq->event_buf = new_buf;
+			rxq->event_sz = new_sz;
+			goto retry;
 		}
 
 		if (unlikely(ret <= 0)) {
-- 
2.43.0