From 6839dae96c264a5c3f343f28977997532e5d0a44 Mon Sep 17 00:00:00 2001 From: Yongseok Koh Date: Mon, 1 May 2017 14:05:42 -0700 Subject: [PATCH] net/mlx5: fix crash on deleting flow drop queue If mlx5_dev_start() fails, it tries to rollback data structures related to rte_flow including drop queue. The destruction code doesn't assume the structures are created but priv_flow_delete_drop_queue() never does sanity check. This can cause a crash. Fixes: 028761059aeb ("net/mlx5: use an RSS drop queue") Signed-off-by: Yongseok Koh Acked-by: Nelio Laranjeiro --- drivers/net/mlx5/mlx5_flow.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/drivers/net/mlx5/mlx5_flow.c b/drivers/net/mlx5/mlx5_flow.c index cd3e5daf3b..adcbe3f522 100644 --- a/drivers/net/mlx5/mlx5_flow.c +++ b/drivers/net/mlx5/mlx5_flow.c @@ -1465,13 +1465,18 @@ priv_flow_delete_drop_queue(struct priv *priv) struct rte_flow_drop *fdq = priv->flow_drop_queue; unsigned int i; - claim_zero(ibv_destroy_qp(fdq->qp)); - claim_zero(ibv_exp_destroy_rwq_ind_table(fdq->ind_table)); + if (!fdq) + return; + if (fdq->qp) + claim_zero(ibv_destroy_qp(fdq->qp)); + if (fdq->ind_table) + claim_zero(ibv_exp_destroy_rwq_ind_table(fdq->ind_table)); for (i = 0; i != MLX5_DROP_WQ_N; ++i) { - assert(fdq->wqs[i]); - claim_zero(ibv_exp_destroy_wq(fdq->wqs[i])); + if (fdq->wqs[i]) + claim_zero(ibv_exp_destroy_wq(fdq->wqs[i])); } - claim_zero(ibv_destroy_cq(fdq->cq)); + if (fdq->cq) + claim_zero(ibv_destroy_cq(fdq->cq)); rte_free(fdq); priv->flow_drop_queue = NULL; }