[PATCH] net/xsc: fix use after free in some RXQ cleanup

[Renyong Wan]

On 2025/9/9 17:22, Thomas Monjalon wrote:
> 09/09/2025 10:08, Renyong Wan:
>> Thanks David for catching this issue.
>> We'll address it in the 25.11 release.
> I don't understand your answer.
> Do you ack this change?
> We want to merge it today because it is breaking our CI on the main branch
> (next-net has been pulled yesterday).
Sorry, I did not carefully read the mail.
Thanks for the fix.

Acked-by: Renyong Wan <wanry at yunsilicon.com>

>
>> On 2025/9/9 15:04, David Marchand wrote:
>>> Debian 12 gcc complains about a use after free in this cleanup section.
>>>
>>> [7/11] Compiling C object drivers/libtmp_rte_net_xsc.a.p/net_xsc_xsc_rx.c.o
>>> In function 'xsc_rss_qp_create',
>>>       inlined from 'xsc_rxq_rss_obj_new' at ../drivers/net/xsc/xsc_rx.c:565:8:
>>> ../drivers/net/xsc/xsc_rx.c:501:9: warning: pointer 'req' may be used after
>>> 	'free' [-Wuse-after-free]
>>>     501 |         free(req);
>>>         |         ^~~~~~~~~
>>> ../drivers/net/xsc/xsc_rx.c:501:9: note: call to 'free' here
>>>
>>> Indeed, req may be free'd twice, as an error in the cleanup loop may
>>> jump back to the set_qp_fail label.
>>>
>>> Instead, skip the erroneous rxq and don't touch errno since all the code
>>> jumping to set_qp_fail already sets it.
>>>
>>> Fixes: 3991c890fb4c ("net/xsc: optimize RSS queue creation")
>>>
>>> Signed-off-by: David Marchand <david.marchand at redhat.com>
>>> ---
>>>    drivers/net/xsc/xsc_rx.c | 6 ++----
>>>    1 file changed, 2 insertions(+), 4 deletions(-)
>>>
>>> diff --git a/drivers/net/xsc/xsc_rx.c b/drivers/net/xsc/xsc_rx.c
>>> index 5f8003a1f6..5ff3f818c2 100644
>>> --- a/drivers/net/xsc/xsc_rx.c
>>> +++ b/drivers/net/xsc/xsc_rx.c
>>> @@ -502,10 +502,8 @@ xsc_rss_qp_create(struct xsc_ethdev_priv *priv, int port_id)
>>>    	for (i = 0; i < set_last_no; i++) {
>>>    		xsc_unset_qp_info(xdev, rqn_base + i);
>>>    		rxq_data = xsc_rxq_get(priv, i);
>>> -		if (rxq_data == NULL) {
>>> -			rte_errno = EINVAL;
>>> -			goto set_qp_fail;
>>> -		}
>>> +		if (rxq_data == NULL)
>>> +			continue;
>>>    		rte_memzone_free(rxq_data->rq_pas);
>>>    		rxq_data->rq_pas = NULL;
>>>    	}
>
>


-- 
Best regards,
Renyong Wan