On Mon, Oct 19, 2026 at 05:47:16PM +0100, Bruce Richardson wrote:
> On Wed, Oct 14, 2026 at 12:24:16PM +0000, Dawid Wesierski wrote:
> > iavf_hierarchy_commit() allocates the queue TC map with calloc(), and
> > it frees the previous map with free(old_qtc_map) after a successful
> > commit. A later change added rte_free(vf->qtc_map) in front of that
> > free(), because it was written for a tree that still leaked the map.
> >
> > After the first commit, rte_free() gets a pointer from the libc
> > heap, and free() then releases the same pointer a second time.
> > rte_free() reads a malloc_elem header in the bytes in front of the
> > pointer. It usually logs "Invalid memory" and returns, but the result
> > depends on the contents of the libc heap.
> >
> > Remove the rte_free() call. free(old_qtc_map) releases the old map.
> >
> > Fixes: f6e33f09f766 ("net/iavf: disable runtime queue setup when rate
> > limiting")
AI review flags the fact that this commit also introduces an erroneous
rte_free call in iavf_uninit_vf() in iavf_ethdev.c. While the call is
harmless (and earler free is done and the pointer is set to NULL making
rte_free a no-op) it would be good to remove that too.
> >
> > Signed-off-by: Dawid Wesierski <[email protected]>
> > ---
> Acked-by: Bruce Richardson <[email protected]>
> > drivers/net/intel/iavf/iavf_tm.c | 1 -
> > 1 file changed, 1 deletion(-)
> >
> > diff --git a/drivers/net/intel/iavf/iavf_tm.c
> > b/drivers/net/intel/iavf/iavf_tm.c
> > index fc84bf7e6b..603da09bb5 100644
> > --- a/drivers/net/intel/iavf/iavf_tm.c
> > +++ b/drivers/net/intel/iavf/iavf_tm.c
> > @@ -913,7 +913,6 @@ static int iavf_hierarchy_commit(struct rte_eth_dev
> > *dev,
> > goto fail_clear;
> >
> > /* replace the previously committed mapping, if any */
> > - rte_free(vf->qtc_map);
> > vf->qtc_map = qtc_map;
> > free(old_qtc_map);
> > if (adapter->stopped == 1)
> > --
> > 2.43.0
> >
