09/09/2025 10:08, Renyong Wan:
> Thanks David for catching this issue.
> We'll address it in the 25.11 release.
I don't understand your answer.
Do you ack this change?
We want to merge it today because it is breaking our CI on the main branch
(next-net has been pulled yesterday).
> On 2025/9/9 15:04, David Marchand wrote:
> > Debian 12 gcc complains about a use after free in this cleanup section.
> >
> > [7/11] Compiling C object drivers/libtmp_rte_net_xsc.a.p/net_xsc_xsc_rx.c.o
> > In function 'xsc_rss_qp_create',
> > inlined from 'xsc_rxq_rss_obj_new' at
> > ../drivers/net/xsc/xsc_rx.c:565:8:
> > ../drivers/net/xsc/xsc_rx.c:501:9: warning: pointer 'req' may be used after
> > 'free' [-Wuse-after-free]
> > 501 | free(req);
> > | ^~~~~~~~~
> > ../drivers/net/xsc/xsc_rx.c:501:9: note: call to 'free' here
> >
> > Indeed, req may be free'd twice, as an error in the cleanup loop may
> > jump back to the set_qp_fail label.
> >
> > Instead, skip the erroneous rxq and don't touch errno since all the code
> > jumping to set_qp_fail already sets it.
> >
> > Fixes: 3991c890fb4c ("net/xsc: optimize RSS queue creation")
> >
> > Signed-off-by: David Marchand <david.march...@redhat.com>
> > ---
> > drivers/net/xsc/xsc_rx.c | 6 ++----
> > 1 file changed, 2 insertions(+), 4 deletions(-)
> >
> > diff --git a/drivers/net/xsc/xsc_rx.c b/drivers/net/xsc/xsc_rx.c
> > index 5f8003a1f6..5ff3f818c2 100644
> > --- a/drivers/net/xsc/xsc_rx.c
> > +++ b/drivers/net/xsc/xsc_rx.c
> > @@ -502,10 +502,8 @@ xsc_rss_qp_create(struct xsc_ethdev_priv *priv, int
> > port_id)
> > for (i = 0; i < set_last_no; i++) {
> > xsc_unset_qp_info(xdev, rqn_base + i);
> > rxq_data = xsc_rxq_get(priv, i);
> > - if (rxq_data == NULL) {
> > - rte_errno = EINVAL;
> > - goto set_qp_fail;
> > - }
> > + if (rxq_data == NULL)
> > + continue;
> > rte_memzone_free(rxq_data->rq_pas);
> > rxq_data->rq_pas = NULL;
> > }
