summaryrefslogtreecommitdiffstats
path: root/src/plugins/rdma/input.c
diff options
context:
space:
mode:
authorBenoît Ganne <bganne@cisco.com>2019-08-05 17:07:20 +0200
committerDave Barach <openvpp@barachs.net>2019-08-06 11:50:43 +0000
commitdd1ccb4fd3b4428714ffcc5bd669fb8c11e46e8e (patch)
treefe5652bbcb2186f8f06d4a98e79e64c64fba29e4 /src/plugins/rdma/input.c
parentae16a801d5ce46fcd7bef11404caa100b0b6d7ea (diff)
rdma: fix double-free in rdma-tx
In case of tx success after multiple retries, the last buffers to be enqueued will be both enqueued for tx and freed. Type: fix Fixes: 211ef2eb24 Change-Id: I57d218cff58b74c1f3d6dc5722624327f0821758 Signed-off-by: Benoît Ganne <bganne@cisco.com>
Diffstat (limited to 'src/plugins/rdma/input.c')
-rw-r--r--src/plugins/rdma/input.c12
1 files changed, 6 insertions, 6 deletions
diff --git a/src/plugins/rdma/input.c b/src/plugins/rdma/input.c
index 7ced1ec66d4..f5091db4719 100644
--- a/src/plugins/rdma/input.c
+++ b/src/plugins/rdma/input.c
@@ -128,12 +128,12 @@ rdma_device_input_refill (vlib_main_t * vm, rdma_device_t * rd,
w[-1].next = 0; /* fix next pointer in WR linked-list last item */
- w = wr;
- ibv_post_wq_recv (rxq->wq, wr, &w);
- n = wr == w ? n_alloc : (uintptr_t) (w - wr);
-
- if (PREDICT_FALSE (n != n_alloc))
- vlib_buffer_free (vm, buffers + n, n_alloc - n);
+ n = n_alloc;
+ if (ibv_post_wq_recv (rxq->wq, wr, &w) != 0)
+ {
+ n = w - wr;
+ vlib_buffer_free (vm, buffers + n, n_alloc - n);
+ }
rxq->n_enq += n;
}