From dd1ccb4fd3b4428714ffcc5bd669fb8c11e46e8e Mon Sep 17 00:00:00 2001 From: Benoît Ganne Date: Mon, 5 Aug 2019 17:07:20 +0200 Subject: rdma: fix double-free in rdma-tx MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit In case of tx success after multiple retries, the last buffers to be enqueued will be both enqueued for tx and freed. Type: fix Fixes: 211ef2eb24 Change-Id: I57d218cff58b74c1f3d6dc5722624327f0821758 Signed-off-by: Benoît Ganne --- src/plugins/rdma/input.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) (limited to 'src/plugins/rdma/input.c') diff --git a/src/plugins/rdma/input.c b/src/plugins/rdma/input.c index 7ced1ec66d4..f5091db4719 100644 --- a/src/plugins/rdma/input.c +++ b/src/plugins/rdma/input.c @@ -128,12 +128,12 @@ rdma_device_input_refill (vlib_main_t * vm, rdma_device_t * rd, w[-1].next = 0; /* fix next pointer in WR linked-list last item */ - w = wr; - ibv_post_wq_recv (rxq->wq, wr, &w); - n = wr == w ? n_alloc : (uintptr_t) (w - wr); - - if (PREDICT_FALSE (n != n_alloc)) - vlib_buffer_free (vm, buffers + n, n_alloc - n); + n = n_alloc; + if (ibv_post_wq_recv (rxq->wq, wr, &w) != 0) + { + n = w - wr; + vlib_buffer_free (vm, buffers + n, n_alloc - n); + } rxq->n_enq += n; } -- cgit 1.2.3-korg