diff mbox

[dpdk-dev] enic: check for nb_free > 0

Message ID 20170802180213.28736-1-aconole@redhat.com (mailing list archive)
State Accepted, archived
Headers

Checks

Context Check Description
ci/checkpatch warning coding style issues
ci/Intel-compilation success Compilation OK

Commit Message

Aaron Conole Aug. 2, 2017, 6:02 p.m. UTC 
  Occasionally, the amount of packets to free from the work queue ends
perfectly on a boundary to have nb_free = 0 and pool = 0.  This causes
a segfault as follows:

  (gdb) bt
  #0  rte_mempool_default_cache (mp=<optimized out>, mp=<optimized out>,
      lcore_id=<optimized out>)
      at /usr/src/debug/openvswitch-2.6.1/dpdk-16.11/x86_64-native-linuxapp-gcc/include/rte_mempool.h:1017
  #1  rte_mempool_put_bulk (n=0, obj_table=0x7f10deff2530, mp=0x0)
      at /usr/src/debug/openvswitch-2.6.1/dpdk-16.11/x86_64-native-linuxapp-gcc/include/rte_mempool.h:1174
  #2  enic_free_wq_bufs (wq=wq@entry=0x7efabffcd5b0,
      completed_index=completed_index@entry=33)
      at /usr/src/debug/openvswitch-2.6.1/dpdk-16.11/drivers/net/enic/enic_rxtx.c:429
  #3  0x00007f11e9c86e17 in enic_cleanup_wq (enic=<optimized out>,
      wq=wq@entry=0x7efabffcd5b0)
      at /usr/src/debug/openvswitch-2.6.1/dpdk-16.11/drivers/net/enic/enic_rxtx.c:442
  #4  0x00007f11e9c86e5f in enic_xmit_pkts (tx_queue=0x7efabffcd5b0,
      tx_pkts=0x7f10deffb1a8, nb_pkts=<optimized out>)
      at /usr/src/debug/openvswitch-2.6.1/dpdk-16.11/drivers/net/enic/enic_rxtx.c:470
  #5  0x00007f11e9e147ad in rte_eth_tx_burst (nb_pkts=<optimized out>,
      tx_pkts=0x7f10deffb1a8, queue_id=0, port_id=<optimized out>)

This commit makes the enic wq driver match other drivers who call the
bulk free, by checking that there are actual packets to free.

Fixes: 36935afbc53c ("net/enic: refactor Tx mbuf recycling")
CC: stable@dpdk.org
Reported-by: Vincent S. Cojot <vcojot@redhat.com>
Reported-at: https://bugzilla.redhat.com/show_bug.cgi?id=1468631
Signed-off-by: Aaron Conole <aconole@redhat.com>
---
 drivers/net/enic/enic_rxtx.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

Comments

John Daley (johndale) Aug. 2, 2017, 6:34 p.m. UTC | #1 
> -----Original Message-----
> From: Aaron Conole [mailto:aconole@redhat.com]
> Sent: Wednesday, August 02, 2017 11:02 AM
> To: dev@dpdk.org
> Cc: stable@dpdk.org; John Daley (johndale) <johndale@cisco.com>; Bruce
> Richardson <bruce.richardson@intel.com>
> Subject: [PATCH] enic: check for nb_free > 0
> 
> Occasionally, the amount of packets to free from the work queue ends
> perfectly on a boundary to have nb_free = 0 and pool = 0.  This causes a
> segfault as follows:
> 
>   (gdb) bt
>   #0  rte_mempool_default_cache (mp=<optimized out>, mp=<optimized
> out>,
>       lcore_id=<optimized out>)
>       at /usr/src/debug/openvswitch-2.6.1/dpdk-16.11/x86_64-native-
> linuxapp-gcc/include/rte_mempool.h:1017
>   #1  rte_mempool_put_bulk (n=0, obj_table=0x7f10deff2530, mp=0x0)
>       at /usr/src/debug/openvswitch-2.6.1/dpdk-16.11/x86_64-native-
> linuxapp-gcc/include/rte_mempool.h:1174
>   #2  enic_free_wq_bufs (wq=wq@entry=0x7efabffcd5b0,
>       completed_index=completed_index@entry=33)
>       at /usr/src/debug/openvswitch-2.6.1/dpdk-
> 16.11/drivers/net/enic/enic_rxtx.c:429
>   #3  0x00007f11e9c86e17 in enic_cleanup_wq (enic=<optimized out>,
>       wq=wq@entry=0x7efabffcd5b0)
>       at /usr/src/debug/openvswitch-2.6.1/dpdk-
> 16.11/drivers/net/enic/enic_rxtx.c:442
>   #4  0x00007f11e9c86e5f in enic_xmit_pkts (tx_queue=0x7efabffcd5b0,
>       tx_pkts=0x7f10deffb1a8, nb_pkts=<optimized out>)
>       at /usr/src/debug/openvswitch-2.6.1/dpdk-
> 16.11/drivers/net/enic/enic_rxtx.c:470
>   #5  0x00007f11e9e147ad in rte_eth_tx_burst (nb_pkts=<optimized out>,
>       tx_pkts=0x7f10deffb1a8, queue_id=0, port_id=<optimized out>)
> 
> This commit makes the enic wq driver match other drivers who call the bulk
> free, by checking that there are actual packets to free.
> 
> Fixes: 36935afbc53c ("net/enic: refactor Tx mbuf recycling")
> CC: stable@dpdk.org
> Reported-by: Vincent S. Cojot <vcojot@redhat.com>
> Reported-at: https://bugzilla.redhat.com/show_bug.cgi?id=1468631
> Signed-off-by: Aaron Conole <aconole@redhat.com>
> ---
>  drivers/net/enic/enic_rxtx.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/net/enic/enic_rxtx.c b/drivers/net/enic/enic_rxtx.c index
> 5867acf..a39172f 100644
> --- a/drivers/net/enic/enic_rxtx.c
> +++ b/drivers/net/enic/enic_rxtx.c
> @@ -503,7 +503,8 @@ static inline void enic_free_wq_bufs(struct vnic_wq
> *wq, u16 completed_index)
>  		tail_idx = enic_ring_incr(desc_count, tail_idx);
>  	}
> 
> -	rte_mempool_put_bulk(pool, (void **)free, nb_free);
> +	if (nb_free > 0)
> +		rte_mempool_put_bulk(pool, (void **)free, nb_free);
> 
>  	wq->tail_idx = tail_idx;
>  	wq->ring.desc_avail += nb_to_free;
> --
> 2.9.4

Reviewed-by: John Daley <johndale@cisco.com>

Thank you!

johnd
Thomas Monjalon Aug. 3, 2017, 8:58 p.m. UTC | #2 
> > Occasionally, the amount of packets to free from the work queue ends
> > perfectly on a boundary to have nb_free = 0 and pool = 0.  This causes a
> > segfault as follows:
> > 
> >   (gdb) bt
> >   #0  rte_mempool_default_cache (mp=<optimized out>, mp=<optimized
> > out>,
> >       lcore_id=<optimized out>)
> >       at /usr/src/debug/openvswitch-2.6.1/dpdk-16.11/x86_64-native-
> > linuxapp-gcc/include/rte_mempool.h:1017
> >   #1  rte_mempool_put_bulk (n=0, obj_table=0x7f10deff2530, mp=0x0)
> >       at /usr/src/debug/openvswitch-2.6.1/dpdk-16.11/x86_64-native-
> > linuxapp-gcc/include/rte_mempool.h:1174
> >   #2  enic_free_wq_bufs (wq=wq@entry=0x7efabffcd5b0,
> >       completed_index=completed_index@entry=33)
> >       at /usr/src/debug/openvswitch-2.6.1/dpdk-
> > 16.11/drivers/net/enic/enic_rxtx.c:429
> >   #3  0x00007f11e9c86e17 in enic_cleanup_wq (enic=<optimized out>,
> >       wq=wq@entry=0x7efabffcd5b0)
> >       at /usr/src/debug/openvswitch-2.6.1/dpdk-
> > 16.11/drivers/net/enic/enic_rxtx.c:442
> >   #4  0x00007f11e9c86e5f in enic_xmit_pkts (tx_queue=0x7efabffcd5b0,
> >       tx_pkts=0x7f10deffb1a8, nb_pkts=<optimized out>)
> >       at /usr/src/debug/openvswitch-2.6.1/dpdk-
> > 16.11/drivers/net/enic/enic_rxtx.c:470
> >   #5  0x00007f11e9e147ad in rte_eth_tx_burst (nb_pkts=<optimized out>,
> >       tx_pkts=0x7f10deffb1a8, queue_id=0, port_id=<optimized out>)
> > 
> > This commit makes the enic wq driver match other drivers who call the bulk
> > free, by checking that there are actual packets to free.
> > 
> > Fixes: 36935afbc53c ("net/enic: refactor Tx mbuf recycling")
> > CC: stable@dpdk.org
> > Reported-by: Vincent S. Cojot <vcojot@redhat.com>
> > Reported-at: https://bugzilla.redhat.com/show_bug.cgi?id=1468631
> > Signed-off-by: Aaron Conole <aconole@redhat.com>
> 
> Reviewed-by: John Daley <johndale@cisco.com>

Applied, thanks

With more context in the title:
	net/enic: fix crash when freeing 0 packet to mempool
diff mbox

Patch

diff --git a/drivers/net/enic/enic_rxtx.c b/drivers/net/enic/enic_rxtx.c
index 5867acf..a39172f 100644
--- a/drivers/net/enic/enic_rxtx.c
+++ b/drivers/net/enic/enic_rxtx.c
@@ -503,7 +503,8 @@  static inline void enic_free_wq_bufs(struct vnic_wq *wq, u16 completed_index)
 		tail_idx = enic_ring_incr(desc_count, tail_idx);
 	}
 
-	rte_mempool_put_bulk(pool, (void **)free, nb_free);
+	if (nb_free > 0)
+		rte_mempool_put_bulk(pool, (void **)free, nb_free);
 
 	wq->tail_idx = tail_idx;
 	wq->ring.desc_avail += nb_to_free;