diff mbox

[dpdk-dev] net/mlx5: fix overflow of Rx SW ring

Message ID 20171005213729.26326-1-yskoh@mellanox.com (mailing list archive)
State Accepted, archived
Delegated to: Ferruh Yigit
Headers

Checks

Context Check Description
ci/checkpatch success coding style OK
ci/Intel-compilation success Compilation OK

Commit Message

Yongseok Koh Oct. 5, 2017, 9:37 p.m. UTC 
  If vectorized Rx burst is short of mbufs in replenishment, Rx SW ring can
overflow as the Rx burst handles 4 packets in a loop. This is because the
function fills SW ring and its mbufs first and checks validity of
each completion later. So, there should be some buffer slots at the tail of
the ring to protect mbufs which are already owned by application.

Fixes: 6cb559d67b83 ("net/mlx5: add vectorized Rx/Tx burst for x86")
Cc: stable@dpdk.org

Reported-by: Martin Weiser <martin.weiser@allegro-packets.com>
Signed-off-by: Yongseok Koh <yskoh@mellanox.com>
---
 drivers/net/mlx5/mlx5_rxtx_vec_sse.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

Comments

Ferruh Yigit Oct. 5, 2017, 10:32 p.m. UTC | #1 
On 10/5/2017 10:37 PM, Yongseok Koh wrote:
> If vectorized Rx burst is short of mbufs in replenishment, Rx SW ring can
> overflow as the Rx burst handles 4 packets in a loop. This is because the
> function fills SW ring and its mbufs first and checks validity of
> each completion later. So, there should be some buffer slots at the tail of
> the ring to protect mbufs which are already owned by application.
> 
> Fixes: 6cb559d67b83 ("net/mlx5: add vectorized Rx/Tx burst for x86")
> Cc: stable@dpdk.org
> 
> Reported-by: Martin Weiser <martin.weiser@allegro-packets.com>
> Signed-off-by: Yongseok Koh <yskoh@mellanox.com>

Applied to dpdk-next-net/master, thanks.
diff mbox

Patch

diff --git a/drivers/net/mlx5/mlx5_rxtx_vec_sse.c b/drivers/net/mlx5/mlx5_rxtx_vec_sse.c
index 20ea38ef9..6d337ecd3 100644
--- a/drivers/net/mlx5/mlx5_rxtx_vec_sse.c
+++ b/drivers/net/mlx5/mlx5_rxtx_vec_sse.c
@@ -640,6 +640,13 @@  rxq_cq_decompress_v(struct mlx5_rxq_data *rxq,
 	RTE_BUILD_BUG_ON(offsetof(struct rte_mbuf, hash) !=
 			 offsetof(struct rte_mbuf, rx_descriptor_fields1) + 12);
 	/*
+	 * Not to overflow elts array. Decompress next time after mbuf
+	 * replenishment.
+	 */
+	if (unlikely(mcqe_n + MLX5_VPMD_DESCS_PER_LOOP >
+		     (uint16_t)(rxq->rq_ci - rxq->cq_ci)))
+		return;
+	/*
 	 * A. load mCQEs into a 128bit register.
 	 * B. store rearm data to mbuf.
 	 * C. combine data from mCQEs with rx_descriptor_fields1.
@@ -1029,8 +1036,10 @@  rxq_burst_v(struct mlx5_rxq_data *rxq, struct rte_mbuf **pkts, uint16_t pkts_n)
 	}
 	elts_idx = rxq->rq_pi & q_mask;
 	elts = &(*rxq->elts)[elts_idx];
-	/* Not to overflow pkts array. */
-	pkts_n = RTE_ALIGN_FLOOR(pkts_n - rcvd_pkt, MLX5_VPMD_DESCS_PER_LOOP);
+	pkts_n = RTE_MIN(pkts_n - rcvd_pkt,
+			 (uint16_t)(rxq->rq_ci - rxq->cq_ci));
+	/* Not to overflow pkts/elts array. */
+	pkts_n = RTE_ALIGN_FLOOR(pkts_n, MLX5_VPMD_DESCS_PER_LOOP);
 	/* Not to cross queue end. */
 	pkts_n = RTE_MIN(pkts_n, q_n - elts_idx);
 	if (!pkts_n)