Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/patches/76660/?format=api
{ "id": 76660, "url": "http://patches.dpdk.org/api/patches/76660/?format=api", "web_url": "http://patches.dpdk.org/project/dpdk/patch/20200907090825.1761-9-huwei013@chinasoftinc.com/", "project": { "id": 1, "url": "http://patches.dpdk.org/api/projects/1/?format=api", "name": "DPDK", "link_name": "dpdk", "list_id": "dev.dpdk.org", "list_email": "dev@dpdk.org", "web_url": "http://core.dpdk.org", "scm_url": "git://dpdk.org/dpdk", "webscm_url": "http://git.dpdk.org/dpdk", "list_archive_url": "https://inbox.dpdk.org/dev", "list_archive_url_format": "https://inbox.dpdk.org/dev/{}", "commit_url_format": "" }, "msgid": "<20200907090825.1761-9-huwei013@chinasoftinc.com>", "list_archive_url": "https://inbox.dpdk.org/dev/20200907090825.1761-9-huwei013@chinasoftinc.com", "date": "2020-09-07T09:08:25", "name": "[8/8] net/hns3: fix segfault when Tx multiple buffer packets", "commit_ref": null, "pull_url": null, "state": "superseded", "archived": true, "hash": "08e867e2c55c26af211fe040f4cb7938322f01f6", "submitter": { "id": 1537, "url": "http://patches.dpdk.org/api/people/1537/?format=api", "name": "Wei Hu (Xavier)", "email": "huwei013@chinasoftinc.com" }, "delegate": { "id": 319, "url": "http://patches.dpdk.org/api/users/319/?format=api", "username": "fyigit", "first_name": "Ferruh", "last_name": "Yigit", "email": "ferruh.yigit@amd.com" }, "mbox": "http://patches.dpdk.org/project/dpdk/patch/20200907090825.1761-9-huwei013@chinasoftinc.com/mbox/", "series": [ { "id": 11986, "url": "http://patches.dpdk.org/api/series/11986/?format=api", "web_url": "http://patches.dpdk.org/project/dpdk/list/?series=11986", "date": "2020-09-07T09:08:17", "name": "net/hns3: updates for Rx Tx", "version": 1, "mbox": "http://patches.dpdk.org/series/11986/mbox/" } ], "comments": "http://patches.dpdk.org/api/patches/76660/comments/", "check": "fail", "checks": "http://patches.dpdk.org/api/patches/76660/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "<dev-bounces@dpdk.org>", "X-Original-To": "patchwork@inbox.dpdk.org", "Delivered-To": "patchwork@inbox.dpdk.org", "Received": [ "from dpdk.org (dpdk.org [92.243.14.124])\n\tby inbox.dpdk.org (Postfix) with ESMTP id 6679EA04B9;\n\tMon, 7 Sep 2020 11:10:22 +0200 (CEST)", "from [92.243.14.124] (localhost [127.0.0.1])\n\tby dpdk.org (Postfix) with ESMTP id 7E1C91C135;\n\tMon, 7 Sep 2020 11:09:25 +0200 (CEST)", "from mail.chinasoftinc.com (unknown [114.113.233.8])\n by dpdk.org (Postfix) with ESMTP id E59131C12D\n for <dev@dpdk.org>; Mon, 7 Sep 2020 11:09:23 +0200 (CEST)", "from localhost.localdomain (65.49.108.226) by INCCAS002.ito.icss\n (10.168.0.60) with Microsoft SMTP Server id 14.3.487.0; Mon, 7 Sep 2020\n 17:09:20 +0800" ], "From": "\"Wei Hu (Xavier)\" <huwei013@chinasoftinc.com>", "To": "<dev@dpdk.org>", "CC": "<xavier.huwei@huawei.com>", "Date": "Mon, 7 Sep 2020 17:08:25 +0800", "Message-ID": "<20200907090825.1761-9-huwei013@chinasoftinc.com>", "X-Mailer": "git-send-email 2.9.5", "In-Reply-To": "<20200907090825.1761-1-huwei013@chinasoftinc.com>", "References": "<20200907090825.1761-1-huwei013@chinasoftinc.com>", "MIME-Version": "1.0", "Content-Type": "text/plain", "X-Originating-IP": "[65.49.108.226]", "Subject": "[dpdk-dev] [PATCH 8/8] net/hns3: fix segfault when Tx multiple\n\tbuffer packets", "X-BeenThere": "dev@dpdk.org", "X-Mailman-Version": "2.1.15", "Precedence": "list", "List-Id": "DPDK patches and discussions <dev.dpdk.org>", "List-Unsubscribe": "<https://mails.dpdk.org/options/dev>,\n <mailto:dev-request@dpdk.org?subject=unsubscribe>", "List-Archive": "<http://mails.dpdk.org/archives/dev/>", "List-Post": "<mailto:dev@dpdk.org>", "List-Help": "<mailto:dev-request@dpdk.org?subject=help>", "List-Subscribe": "<https://mails.dpdk.org/listinfo/dev>,\n <mailto:dev-request@dpdk.org?subject=subscribe>", "Errors-To": "dev-bounces@dpdk.org", "Sender": "\"dev\" <dev-bounces@dpdk.org>" }, "content": "From: Chengchang Tang <tangchengchang@huawei.com>\n\nCurrently, there is a possibility that segment faults occur when sending\npackets whose payloads are stored in multiple buffers based on hns3 network\nengine. The related core dump information as follows:\n\nProgram terminated with signal 11, Segmentation fault.\n0 hns3_reassemble_tx_pkts\n2512 temp = temp->next;\nMissing separate debuginfos, use:\n(gdb) bt\n0 hns3_reassemble_tx_pkts\n1 0x0000000000969c60 in hns3_check_non_tso_pkt\n2 0x000000000096adbc in hns3_xmit_pkts\n3 0x000000000050d4d0 in rte_eth_tx_burst\n4 0x000000000050fca4 in pkt_burst_transmit\n5 0x00000000004ca6b8 in run_pkt_fwd_on_lcore\n6 0x00000000004ca7fc in start_pkt_forward_on_core\n7 0x00000000006975a4 in eal_thread_loop\n8 0x0000ffffa6f7fc48 in start_thread\n9 0x0000ffffa6ed1600 in thread_start\n\nThe root cause is that hns3 PMD driver invokes the rte_pktmbuf_free_seg API\nfunction to release the same rte_mbuf multiple times. The rte_mbuf pointer\nis not set to NULL in the internal function hns3_rx_queue_release_mbufs\nwhich is invoked during queue setup, stop and close. As a result the\nrte_mbuf in Rx queues will be repeatedly released when the user application\nsetup queues or stop/start the dev for multiple times. Probably for\nperformance reasons, DPDK mempool lib does not check for the repeated\nrte_mbuf releases. The Address of released rte_mbuf are directly stored\ninto the per lcore cache of the mempool. This makes the rte_mbufs obtained\nfrom mempool by calling rte_mempool_get_bulk API function repetitively.\nultimately, it causes to access to a NULL pointer in PMD driver.\n\nThis patch fixes this problem by setting released mbuf pointer to NULL in\nthe internal function named hns3_rx_queue_release_mbuf. And the other\ninternal function named hns3_reassemble_tx_pkts is optimized to avoid a\nsimilar problem.\n\nFixes: bba636698316 (\"net/hns3: support Rx/Tx and related operations\")\nCc: stable@dpdk.org\n\nSigned-off-by: Chengchang Tang <tangchengchang@huawei.com>\nSigned-off-by: Wei Hu (Xavier) <xavier.huwei@huawei.com>\nSigned-off-by: Chengwen Feng <fengchengwen@huawei.com>\n---\n drivers/net/hns3/hns3_rxtx.c | 61 +++++++++++++++++---------------------------\n 1 file changed, 23 insertions(+), 38 deletions(-)", "diff": "diff --git a/drivers/net/hns3/hns3_rxtx.c b/drivers/net/hns3/hns3_rxtx.c\nindex 03d69b1..1a1f828 100644\n--- a/drivers/net/hns3/hns3_rxtx.c\n+++ b/drivers/net/hns3/hns3_rxtx.c\n@@ -43,15 +43,19 @@ hns3_rx_queue_release_mbufs(struct hns3_rx_queue *rxq)\n \n \tif (rxq->rx_rearm_nb == 0) {\n \t\tfor (i = 0; i < rxq->nb_rx_desc; i++) {\n-\t\t\tif (rxq->sw_ring[i].mbuf != NULL)\n+\t\t\tif (rxq->sw_ring[i].mbuf != NULL) {\n \t\t\t\trte_pktmbuf_free_seg(rxq->sw_ring[i].mbuf);\n+\t\t\t\trxq->sw_ring[i].mbuf = NULL;\n+\t\t\t}\n \t\t}\n \t} else {\n \t\tfor (i = rxq->next_to_use;\n \t\t i != rxq->rx_rearm_start;\n \t\t i = (i + 1) % rxq->nb_rx_desc) {\n-\t\t\tif (rxq->sw_ring[i].mbuf != NULL)\n+\t\t\tif (rxq->sw_ring[i].mbuf != NULL) {\n \t\t\t\trte_pktmbuf_free_seg(rxq->sw_ring[i].mbuf);\n+\t\t\t\trxq->sw_ring[i].mbuf = NULL;\n+\t\t\t}\n \t\t}\n \t}\n \n@@ -2368,37 +2372,24 @@ hns3_fill_first_desc(struct hns3_tx_queue *txq, struct hns3_desc *desc,\n \t}\n }\n \n-static int\n-hns3_tx_alloc_mbufs(struct hns3_tx_queue *txq, struct rte_mempool *mb_pool,\n-\t\t uint16_t nb_new_buf, struct rte_mbuf **alloc_mbuf)\n+static inline int\n+hns3_tx_alloc_mbufs(struct rte_mempool *mb_pool, uint16_t nb_new_buf,\n+\t\t\tstruct rte_mbuf **alloc_mbuf)\n {\n-\tstruct rte_mbuf *new_mbuf = NULL;\n-\tstruct rte_eth_dev *dev;\n-\tstruct rte_mbuf *temp;\n-\tstruct hns3_hw *hw;\n+#define MAX_NON_TSO_BD_PER_PKT 18\n+\tstruct rte_mbuf *pkt_segs[MAX_NON_TSO_BD_PER_PKT];\n \tuint16_t i;\n \n \t/* Allocate enough mbufs */\n-\tfor (i = 0; i < nb_new_buf; i++) {\n-\t\ttemp = rte_pktmbuf_alloc(mb_pool);\n-\t\tif (unlikely(temp == NULL)) {\n-\t\t\tdev = &rte_eth_devices[txq->port_id];\n-\t\t\thw = HNS3_DEV_PRIVATE_TO_HW(dev->data->dev_private);\n-\t\t\thns3_err(hw, \"Failed to alloc TX mbuf port_id=%d,\"\n-\t\t\t\t \"queue_id=%d in reassemble tx pkts.\",\n-\t\t\t\t txq->port_id, txq->queue_id);\n-\t\t\trte_pktmbuf_free(new_mbuf);\n-\t\t\treturn -ENOMEM;\n-\t\t}\n-\t\ttemp->next = new_mbuf;\n-\t\tnew_mbuf = temp;\n-\t}\n-\n-\tif (new_mbuf == NULL)\n+\tif (rte_mempool_get_bulk(mb_pool, (void **)pkt_segs, nb_new_buf))\n \t\treturn -ENOMEM;\n \n-\tnew_mbuf->nb_segs = nb_new_buf;\n-\t*alloc_mbuf = new_mbuf;\n+\tfor (i = 0; i < nb_new_buf - 1; i++)\n+\t\tpkt_segs[i]->next = pkt_segs[i + 1];\n+\n+\tpkt_segs[nb_new_buf - 1]->next = NULL;\n+\tpkt_segs[0]->nb_segs = nb_new_buf;\n+\t*alloc_mbuf = pkt_segs[0];\n \n \treturn 0;\n }\n@@ -2418,10 +2409,8 @@ hns3_pktmbuf_copy_hdr(struct rte_mbuf *new_pkt, struct rte_mbuf *old_pkt)\n }\n \n static int\n-hns3_reassemble_tx_pkts(void *tx_queue, struct rte_mbuf *tx_pkt,\n-\t\t\tstruct rte_mbuf **new_pkt)\n+hns3_reassemble_tx_pkts(struct rte_mbuf *tx_pkt, struct rte_mbuf **new_pkt)\n {\n-\tstruct hns3_tx_queue *txq = tx_queue;\n \tstruct rte_mempool *mb_pool;\n \tstruct rte_mbuf *new_mbuf;\n \tstruct rte_mbuf *temp_new;\n@@ -2433,7 +2422,6 @@ hns3_reassemble_tx_pkts(void *tx_queue, struct rte_mbuf *tx_pkt,\n \tuint16_t len_s;\n \tuint16_t len_d;\n \tuint16_t len;\n-\tuint16_t i;\n \tint ret;\n \tchar *s;\n \tchar *d;\n@@ -2449,7 +2437,7 @@ hns3_reassemble_tx_pkts(void *tx_queue, struct rte_mbuf *tx_pkt,\n \t\tlast_buf_len = buf_size;\n \n \t/* Allocate enough mbufs */\n-\tret = hns3_tx_alloc_mbufs(txq, mb_pool, nb_new_buf, &new_mbuf);\n+\tret = hns3_tx_alloc_mbufs(mb_pool, nb_new_buf, &new_mbuf);\n \tif (ret)\n \t\treturn ret;\n \n@@ -2458,12 +2446,9 @@ hns3_reassemble_tx_pkts(void *tx_queue, struct rte_mbuf *tx_pkt,\n \ts = rte_pktmbuf_mtod(temp, char *);\n \tlen_s = rte_pktmbuf_data_len(temp);\n \ttemp_new = new_mbuf;\n-\tfor (i = 0; i < nb_new_buf; i++) {\n+\twhile (temp != NULL && temp_new != NULL) {\n \t\td = rte_pktmbuf_mtod(temp_new, char *);\n-\t\tif (i < nb_new_buf - 1)\n-\t\t\tbuf_len = buf_size;\n-\t\telse\n-\t\t\tbuf_len = last_buf_len;\n+\t\tbuf_len = temp_new->next == NULL ? last_buf_len : buf_size;\n \t\tlen_d = buf_len;\n \n \t\twhile (len_d) {\n@@ -2924,7 +2909,7 @@ hns3_check_non_tso_pkt(uint16_t nb_buf, struct rte_mbuf **m_seg,\n \n \tif (unlikely(nb_buf > HNS3_MAX_NON_TSO_BD_PER_PKT)) {\n \t\ttxq->exceed_limit_bd_pkt_cnt++;\n-\t\tret = hns3_reassemble_tx_pkts(txq, tx_pkt, &new_pkt);\n+\t\tret = hns3_reassemble_tx_pkts(tx_pkt, &new_pkt);\n \t\tif (ret) {\n \t\t\ttxq->exceed_limit_bd_reassem_fail++;\n \t\t\treturn ret;\n", "prefixes": [ "8/8" ] }