On Wed, Oct 14, 2026 at 12:24:16PM +0000, Dawid Wesierski wrote:
> iavf_hierarchy_commit() allocates the queue TC map with calloc(), and
> it frees the previous map with free(old_qtc_map) after a successful
> commit. A later change added rte_free(vf->qtc_map) in front of that
> free(), because it was written for a tree that still leaked the map.
>
> After the first commit, rte_free() gets a pointer from the libc
> heap, and free() then releases the same pointer a second time.
> rte_free() reads a malloc_elem header in the bytes in front of the
> pointer. It usually logs "Invalid memory" and returns, but the result
> depends on the contents of the libc heap.
>
> Remove the rte_free() call. free(old_qtc_map) releases the old map.
>
> Fixes: f6e33f09f766 ("net/iavf: disable runtime queue setup when rate
> limiting")
>
> Signed-off-by: Dawid Wesierski <[email protected]>
> ---
Acked-by: Bruce Richardson <[email protected]>
> drivers/net/intel/iavf/iavf_tm.c | 1 -
> 1 file changed, 1 deletion(-)
>
> diff --git a/drivers/net/intel/iavf/iavf_tm.c
> b/drivers/net/intel/iavf/iavf_tm.c
> index fc84bf7e6b..603da09bb5 100644
> --- a/drivers/net/intel/iavf/iavf_tm.c
> +++ b/drivers/net/intel/iavf/iavf_tm.c
> @@ -913,7 +913,6 @@ static int iavf_hierarchy_commit(struct rte_eth_dev *dev,
> goto fail_clear;
>
> /* replace the previously committed mapping, if any */
> - rte_free(vf->qtc_map);
> vf->qtc_map = qtc_map;
> free(old_qtc_map);
> if (adapter->stopped == 1)
> --
> 2.43.0
>
