In nfp_flower_ctrl_vnic_nfd3_xmit(), when txq is NULL, goto xmit_end
leads to unconditional dereference of txq->qcp_q in nfp_qcp_ptr_add().
The same goto from the "no free descriptors" path incorrectly increments
the hardware write pointer despite no descriptor being written.
Replace both gotos with early return, removing the unused xmit_end label.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: a36634e87e16 ("net/nfp: add flower ctrl VNIC Rx/Tx")
Cc: [email protected]
Signed-off-by: Denis Sergeev <[email protected]>
---
drivers/net/nfp/flower/nfp_flower_ctrl.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/net/nfp/flower/nfp_flower_ctrl.c
b/drivers/net/nfp/flower/nfp_flower_ctrl.c
index 6ac2caf367..1fa751a106 100644
--- a/drivers/net/nfp/flower/nfp_flower_ctrl.c
+++ b/drivers/net/nfp/flower/nfp_flower_ctrl.c
@@ -168,7 +168,7 @@ nfp_flower_ctrl_vnic_nfd3_xmit(struct nfp_app_fw_flower
*app_fw_flower,
* enabled. But the queue needs to be configured.
*/
PMD_TX_LOG(ERR, "Ctrl dev TX Bad queue.");
- goto xmit_end;
+ return 0;
}
txds = &txq->txds[txq->wr_p];
@@ -183,7 +183,7 @@ nfp_flower_ctrl_vnic_nfd3_xmit(struct nfp_app_fw_flower
*app_fw_flower,
free_descs = nfp_net_nfd3_free_tx_desc(txq);
if (unlikely(free_descs == 0)) {
PMD_TX_LOG(ERR, "Ctrl dev no free descs.");
- goto xmit_end;
+ return 0;
}
lmbuf = &txq->txbufs[txq->wr_p].mbuf;
@@ -207,7 +207,6 @@ nfp_flower_ctrl_vnic_nfd3_xmit(struct nfp_app_fw_flower
*app_fw_flower,
cnt++;
app_fw_flower->ctrl_vnic_tx_count++;
-xmit_end:
rte_wmb();
nfp_qcp_ptr_add(txq->qcp_q, NFP_QCP_WRITE_PTR, 1);
--
2.50.1
