From patchwork Fri Oct 27 06:09:41 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jie Hai X-Patchwork-Id: 133471 X-Patchwork-Delegate: ferruh.yigit@amd.com Return-Path: X-Original-To: patchwork@inbox.dpdk.org Delivered-To: patchwork@inbox.dpdk.org Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id AC0E243212; Fri, 27 Oct 2023 08:13:53 +0200 (CEST) Received: from mails.dpdk.org (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 7C94C402D4; Fri, 27 Oct 2023 08:13:53 +0200 (CEST) Received: from szxga01-in.huawei.com (szxga01-in.huawei.com [45.249.212.187]) by mails.dpdk.org (Postfix) with ESMTP id 7D8D140272 for ; Fri, 27 Oct 2023 08:13:51 +0200 (CEST) Received: from kwepemi500020.china.huawei.com (unknown [172.30.72.54]) by szxga01-in.huawei.com (SkyGuard) with ESMTP id 4SGsgC4w4dzpWZF for ; Fri, 27 Oct 2023 14:08:55 +0800 (CST) Received: from localhost.localdomain (10.67.165.2) by kwepemi500020.china.huawei.com (7.221.188.8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.31; Fri, 27 Oct 2023 14:13:49 +0800 From: Jie Hai To: , Yisen Zhuang , "Wei Hu (Xavier)" , Huisong Li , Chengwen Feng , Dongdong Liu CC: Subject: [PATCH 3/8] net/hns3: fix segmentfault for NEON and SVE Date: Fri, 27 Oct 2023 14:09:41 +0800 Message-ID: <20231027060947.3183983-4-haijie1@huawei.com> X-Mailer: git-send-email 2.30.0 In-Reply-To: <20231027060947.3183983-1-haijie1@huawei.com> References: <20231027060947.3183983-1-haijie1@huawei.com> MIME-Version: 1.0 X-Originating-IP: [10.67.165.2] X-ClientProxiedBy: dggems703-chm.china.huawei.com (10.3.19.180) To kwepemi500020.china.huawei.com (7.221.188.8) X-CFilter-Loop: Reflected X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org From: Huisong Li Driver may fail to allocate bulk mbufs for Neon and SVE when rearm mbuf. Currently, driver keeps going to handle packets even if there isn't available descriptors to receive packets at this moment. As a result, driver probably fills the mbufs with invalid data to application and accesses to illegal address because of the VLD bit of the descriptor at the "rx_rearm_start" position still being set. So driver has to clear VLD bit for this descriptor in this scenario in case of receiving packets later. In addition, it is possible that the sum of the "rx_rearm_nb" and "rx_rearm_start" is greater than total descriptor number of Rx queue in the above scenario. So the index of rxq->sw_ring[] to set mbuf pointer to NULL should also be fixed to avoid out-of-bounds memory access. Fixes: a3d4f4d291d7 ("net/hns3: support NEON Rx") Fixes: f81a18f49152 ("net/hns3: fix mbuf leakage when RxQ started after reset") Cc: stable@dpdk.org Signed-off-by: Huisong Li --- drivers/net/hns3/hns3_rxtx.c | 2 +- drivers/net/hns3/hns3_rxtx_vec.h | 5 +++++ 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/net/hns3/hns3_rxtx.c b/drivers/net/hns3/hns3_rxtx.c index 13214d02d536..f28ca040be41 100644 --- a/drivers/net/hns3/hns3_rxtx.c +++ b/drivers/net/hns3/hns3_rxtx.c @@ -51,7 +51,7 @@ hns3_rx_queue_release_mbufs(struct hns3_rx_queue *rxq) } } for (i = 0; i < rxq->rx_rearm_nb; i++) - rxq->sw_ring[rxq->rx_rearm_start + i].mbuf = NULL; + rxq->sw_ring[(rxq->rx_rearm_start + i) % rxq->nb_rx_desc].mbuf = NULL; } for (i = 0; i < rxq->bulk_mbuf_num; i++) diff --git a/drivers/net/hns3/hns3_rxtx_vec.h b/drivers/net/hns3/hns3_rxtx_vec.h index a9a6774294ef..9018e79c2f92 100644 --- a/drivers/net/hns3/hns3_rxtx_vec.h +++ b/drivers/net/hns3/hns3_rxtx_vec.h @@ -106,6 +106,11 @@ hns3_rxq_rearm_mbuf(struct hns3_rx_queue *rxq) if (unlikely(rte_mempool_get_bulk(rxq->mb_pool, (void *)rxep, HNS3_DEFAULT_RXQ_REARM_THRESH) < 0)) { + /* + * Clear VLD bit for the first descriptor rearmed in case + * of going to receive packets later. + */ + rxdp[0].rx.bd_base_info = 0; rte_eth_devices[rxq->port_id].data->rx_mbuf_alloc_failed++; return; }