In tap_mp_attach_queues(), if the reply queue count does not match
the number of received file descriptors, the function returns -1
without freeing the reply buffer allocated by rte_mp_request_sync().
Add the missing free().
Bugzilla ID: 1881
Fixes: 9ad43ad8fbee ("net/tap: fix potential IPC buffer overrun")
Cc: [email protected]
Signed-off-by: Stephen Hemminger <[email protected]>
---
drivers/net/tap/rte_eth_tap.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/tap/rte_eth_tap.c b/drivers/net/tap/rte_eth_tap.c
index 251b05b27b..6676a40d69 100644
--- a/drivers/net/tap/rte_eth_tap.c
+++ b/drivers/net/tap/rte_eth_tap.c
@@ -2407,6 +2407,7 @@ tap_mp_attach_queues(const char *port_name, struct
rte_eth_dev *dev)
/* Attach the queues from received file descriptors */
if (reply_param->q_count != reply->num_fds) {
TAP_LOG(ERR, "Unexpected number of fds received");
+ free(reply);
return -1;
}
--
2.51.0
