1) in function vmxnet3_dev_tx_queue_setup():
   The momory of 'txq' is stored to 'dev->data->tx_queues[queue_idx]'
   at the end of the function. When function returned early in the
   error handling, 'txq' is not released which leads to a memory leak.
2) in function vmxnet3_dev_rx_queue_setup():
   Same reason to case 1) with memory 'rxq'.

Fixes: dfaff37fc46d ("vmxnet3: import new vmxnet3 poll mode driver 
implementation")

Signed-off-by: Weiguo Li <liw...@foxmail.com>
---
 drivers/net/vmxnet3/vmxnet3_rxtx.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/net/vmxnet3/vmxnet3_rxtx.c 
b/drivers/net/vmxnet3/vmxnet3_rxtx.c
index d745064bc4..3d1c6080e8 100644
--- a/drivers/net/vmxnet3/vmxnet3_rxtx.c
+++ b/drivers/net/vmxnet3/vmxnet3_rxtx.c
@@ -1057,10 +1057,12 @@ vmxnet3_dev_tx_queue_setup(struct rte_eth_dev *dev,
 
        /* Tx vmxnet ring length should be between 512-4096 */
        if (nb_desc < VMXNET3_DEF_TX_RING_SIZE) {
+               rte_free(txq);
                PMD_INIT_LOG(ERR, "VMXNET3 Tx Ring Size Min: %u",
                             VMXNET3_DEF_TX_RING_SIZE);
                return -EINVAL;
        } else if (nb_desc > VMXNET3_TX_RING_MAX_SIZE) {
+               rte_free(txq);
                PMD_INIT_LOG(ERR, "VMXNET3 Tx Ring Size Max: %u",
                             VMXNET3_TX_RING_MAX_SIZE);
                return -EINVAL;
@@ -1084,6 +1086,7 @@ vmxnet3_dev_tx_queue_setup(struct rte_eth_dev *dev,
        mz = rte_eth_dma_zone_reserve(dev, "txdesc", queue_idx, size,
                                      VMXNET3_RING_BA_ALIGN, socket_id);
        if (mz == NULL) {
+               rte_free(txq);
                PMD_INIT_LOG(ERR, "ERROR: Creating queue descriptors zone");
                return -ENOMEM;
        }
@@ -1108,6 +1111,7 @@ vmxnet3_dev_tx_queue_setup(struct rte_eth_dev *dev,
        ring->buf_info = rte_zmalloc("tx_ring_buf_info",
                                     ring->size * sizeof(vmxnet3_buf_info_t), 
RTE_CACHE_LINE_SIZE);
        if (ring->buf_info == NULL) {
+               rte_free(txq);
                PMD_INIT_LOG(ERR, "ERROR: Creating tx_buf_info structure");
                return -ENOMEM;
        }
@@ -1163,9 +1167,11 @@ vmxnet3_dev_rx_queue_setup(struct rte_eth_dev *dev,
 
        /* Rx vmxnet rings length should be between 256-4096 */
        if (nb_desc < VMXNET3_DEF_RX_RING_SIZE) {
+               rte_free(rxq);
                PMD_INIT_LOG(ERR, "VMXNET3 Rx Ring Size Min: 256");
                return -EINVAL;
        } else if (nb_desc > VMXNET3_RX_RING_MAX_SIZE) {
+               rte_free(rxq);
                PMD_INIT_LOG(ERR, "VMXNET3 Rx Ring Size Max: 4096");
                return -EINVAL;
        } else {
@@ -1195,6 +1201,7 @@ vmxnet3_dev_rx_queue_setup(struct rte_eth_dev *dev,
        mz = rte_eth_dma_zone_reserve(dev, "rxdesc", queue_idx, size,
                                      VMXNET3_RING_BA_ALIGN, socket_id);
        if (mz == NULL) {
+               rte_free(rxq);
                PMD_INIT_LOG(ERR, "ERROR: Creating queue descriptors zone");
                return -ENOMEM;
        }
@@ -1233,6 +1240,7 @@ vmxnet3_dev_rx_queue_setup(struct rte_eth_dev *dev,
                                             ring->size * 
sizeof(vmxnet3_buf_info_t),
                                             RTE_CACHE_LINE_SIZE);
                if (ring->buf_info == NULL) {
+                       rte_free(rxq);
                        PMD_INIT_LOG(ERR, "ERROR: Creating rx_buf_info 
structure");
                        return -ENOMEM;
                }
-- 
2.25.1

Reply via email to