rte_realloc() failure overwrites event_buf and leaks the old allocation.
Use a temporary pointer and update event_buf and event_sz only on success,
preserving the existing buffer and size on failure.
Fixes: 1f2766b7ee02 ("net/netvsc: resize event buffer as needed")
Cc: [email protected]
Signed-off-by: Chen Zhao <[email protected]>
---
v2:
- Preserve the existing buffer and size on allocation failure.
- Update the buffer pointer and size only on success.
- Remove the obsolete Microsoft email address.
.mailmap | 1 +
drivers/net/netvsc/hn_rxtx.c | 18 ++++++++++--------
2 files changed, 11 insertions(+), 8 deletions(-)
diff --git a/.mailmap b/.mailmap
index 6d9e262cfb..deae6514dd 100644
--- a/.mailmap
+++ b/.mailmap
@@ -267,6 +267,7 @@ Charles Myers <[email protected]>
Charles Stoll <[email protected]>
Chas Williams <[email protected]> <[email protected]>
Chas Williams <[email protected]> <[email protected]>
+Chen Zhao <[email protected]>
Chenbo Xia <[email protected]> <[email protected]>
Cheng Jiang <[email protected]> <[email protected]>
Cheng Liu <[email protected]>
diff --git a/drivers/net/netvsc/hn_rxtx.c b/drivers/net/netvsc/hn_rxtx.c
index 6f536610f2..f38fc33f7c 100644
--- a/drivers/net/netvsc/hn_rxtx.c
+++ b/drivers/net/netvsc/hn_rxtx.c
@@ -1131,17 +1131,19 @@ uint32_t hn_process_events(struct hn_data *hv, uint16_t
queue_id,
if (unlikely(ret == -ENOBUFS)) {
/* event buffer not large enough to read ring */
+ uint32_t new_sz = len + len / 4;
+ void *new_buf;
PMD_DRV_LOG(DEBUG,
"event buffer expansion (need %u)", len);
- rxq->event_sz = len + len / 4;
- rxq->event_buf = rte_realloc(rxq->event_buf,
rxq->event_sz,
- RTE_CACHE_LINE_SIZE);
- if (rxq->event_buf)
- goto retry;
- /* out of memory, no more events now */
- rxq->event_sz = 0;
- break;
+ new_buf = rte_realloc(rxq->event_buf, new_sz,
+ RTE_CACHE_LINE_SIZE);
+ if (new_buf == NULL)
+ break; /* out of memory, no more events now */
+
+ rxq->event_buf = new_buf;
+ rxq->event_sz = new_sz;
+ goto retry;
}
if (unlikely(ret <= 0)) {
--
2.43.0
