<html>
    <head>
      <base href="https://bugs.dpdk.org/">
    </head>
    <body><table border="1" cellspacing="0" cellpadding="8" class="bz_new_table">
        <tr>
          <th>Bug ID</th>
          <td><a class="bz_bug_link 
          bz_status_UNCONFIRMED "
   title="UNCONFIRMED - mlx5: segmentation fault with rte_flow_configure function"
   href="https://bugs.dpdk.org/show_bug.cgi?id=1199">1199</a>
          </td>
        </tr>

        <tr>
          <th>Summary</th>
          <td>mlx5: segmentation fault with rte_flow_configure function
          </td>
        </tr>

        <tr>
          <th>Product</th>
          <td>DPDK
          </td>
        </tr>

        <tr>
          <th>Version</th>
          <td>23.03
          </td>
        </tr>

        <tr>
          <th>Hardware</th>
          <td>All
          </td>
        </tr>

        <tr>
          <th>OS</th>
          <td>All
          </td>
        </tr>

        <tr>
          <th>Status</th>
          <td>UNCONFIRMED
          </td>
        </tr>

        <tr>
          <th>Severity</th>
          <td>major
          </td>
        </tr>

        <tr>
          <th>Priority</th>
          <td>Normal
          </td>
        </tr>

        <tr>
          <th>Component</th>
          <td>ethdev
          </td>
        </tr>

        <tr>
          <th>Assignee</th>
          <td>dev@dpdk.org
          </td>
        </tr>

        <tr>
          <th>Reporter</th>
          <td>ccm@ccm.ink
          </td>
        </tr>

        <tr>
          <th>Target Milestone</th>
          <td>---
          </td>
        </tr></table>
      <p>
        <div class="bz_comment_block">
          <pre class="bz_comment_text">I encountered a segmentation fault when attempting to configure queues for the
asynchronous version of rte_flow using the DPDK rte_flow_configure function and
assigning varying sizes to each queue.

Just like this:
  const struct rte_flow_queue_attr *queue_attr[2];
  struct rte_flow_queue_attr setup_queue_attr = {.size = 32};
  struct rte_flow_queue_attr normal_queue_attr = {.size = 100};
  queue_attr[0] = &setup_queue_attr;
  queue_attr[1] = &normal_queue_attr;
  rte_flow_configure(port_id, &port_attr, 2, queue_attr, &err);


Upon reviewing the source code, I discovered that an attempt was made to free
an unallocated memory, which could potentially result in a segmentation
fault(line 7470).

[mlx5_flow_hw.c]
7226 if (_queue_attr[i]->size != _queue_attr[0]->size) {
        rte_errno = EINVAL;
        goto err;
7229 }
...
7239    priv->hw_q = mlx5_malloc(MLX5_MEM_ZERO, mem_size,
7240                             64, SOCKET_ID_ANY);
...
7444  err:
...
7469    for (i = 0; i < nb_q_updated; i++) {
7470            rte_ring_free(priv->hw_q[i].indir_iq);
                rte_ring_free(priv->hw_q[i].indir_cq);
        }
7473    mlx5_free(priv->hw_q);
          </pre>
        </div>
      </p>


      <hr>
      <span>You are receiving this mail because:</span>

      <ul>
          <li>You are the assignee for the bug.</li>
      </ul>
      <div itemscope itemtype="http://schema.org/EmailMessage">
        <div itemprop="action" itemscope itemtype="http://schema.org/ViewAction">
          
          <link itemprop="url" href="https://bugs.dpdk.org/show_bug.cgi?id=1199">
          <meta itemprop="name" content="View bug">
        </div>
        <meta itemprop="description" content="Bugzilla bug update notification">
      </div>
    </body>
</html>