[PATCH] net/xsc: fix use after free in some RXQ cleanup

[David Marchand]

Debian 12 gcc complains about a use after free in this cleanup section.

[7/11] Compiling C object drivers/libtmp_rte_net_xsc.a.p/net_xsc_xsc_rx.c.o
In function 'xsc_rss_qp_create',
    inlined from 'xsc_rxq_rss_obj_new' at ../drivers/net/xsc/xsc_rx.c:565:8:
../drivers/net/xsc/xsc_rx.c:501:9: warning: pointer 'req' may be used after
        'free' [-Wuse-after-free]
  501 |         free(req);
      |         ^~~~~~~~~
../drivers/net/xsc/xsc_rx.c:501:9: note: call to 'free' here

Indeed, req may be free'd twice, as an error in the cleanup loop may
jump back to the set_qp_fail label.

Instead, skip the erroneous rxq and don't touch errno since all the code
jumping to set_qp_fail already sets it.

Fixes: 3991c890fb4c ("net/xsc: optimize RSS queue creation")

Signed-off-by: David Marchand <david.march...@redhat.com>
---
 drivers/net/xsc/xsc_rx.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/drivers/net/xsc/xsc_rx.c b/drivers/net/xsc/xsc_rx.c
index 5f8003a1f6..5ff3f818c2 100644
--- a/drivers/net/xsc/xsc_rx.c
+++ b/drivers/net/xsc/xsc_rx.c
@@ -502,10 +502,8 @@ xsc_rss_qp_create(struct xsc_ethdev_priv *priv, int 
port_id)
        for (i = 0; i < set_last_no; i++) {
                xsc_unset_qp_info(xdev, rqn_base + i);
                rxq_data = xsc_rxq_get(priv, i);
-               if (rxq_data == NULL) {
-                       rte_errno = EINVAL;
-                       goto set_qp_fail;
-               }
+               if (rxq_data == NULL)
+                       continue;
                rte_memzone_free(rxq_data->rq_pas);
                rxq_data->rq_pas = NULL;
        }
-- 
2.51.0