eventdev/rx_adapter: fix wrr buffer overrun issue

  when a poll queue is removed from a rx_adapter instance, the wrr poll
array is recomputed. The wrr array length is reduced in this case. The
next wrr position to poll is stored in wrr_pos variable of rx_adapter
instance. This wrr_pos can become invalid in some cases after wrr is
recomputed. Using this variable to get the next queue and device pair
may leed to wrr buffer overruns.

Resetting the wrr_pos to zero after recomputation of wrr array fixes
the buffer overrun issue.

Fixes: 9c38b704d280 ("eventdev: add eth Rx adapter implementation")

Signed-off-by: Naga Harish K S V <s.v.naga.harish.k@intel.com>
---
 lib/eventdev/rte_event_eth_rx_adapter.c | 5 +++++
 1 file changed, 5 insertions(+)
  

Acked-by: Jay Jayatheerthan <jay.jayatheerthan@intel.com>

> -----Original Message-----
> From: Naga Harish K, S V <s.v.naga.harish.k@intel.com>
> Sent: Monday, October 18, 2021 1:56 PM
> To: jerinj@marvell.com; Jayatheerthan, Jay <jay.jayatheerthan@intel.com>
> Cc: dev@dpdk.org
> Subject: [PATCH] eventdev/rx_adapter: fix wrr buffer overrun issue
> 
> when a poll queue is removed from a rx_adapter instance, the wrr poll
> array is recomputed. The wrr array length is reduced in this case. The
> next wrr position to poll is stored in wrr_pos variable of rx_adapter
> instance. This wrr_pos can become invalid in some cases after wrr is
> recomputed. Using this variable to get the next queue and device pair
> may leed to wrr buffer overruns.
> 
> Resetting the wrr_pos to zero after recomputation of wrr array fixes
> the buffer overrun issue.
> 
> Fixes: 9c38b704d280 ("eventdev: add eth Rx adapter implementation")
> 
> Signed-off-by: Naga Harish K S V <s.v.naga.harish.k@intel.com>
> ---
>  lib/eventdev/rte_event_eth_rx_adapter.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/lib/eventdev/rte_event_eth_rx_adapter.c b/lib/eventdev/rte_event_eth_rx_adapter.c
> index bd68b8efe1..82a652d305 100644
> --- a/lib/eventdev/rte_event_eth_rx_adapter.c
> +++ b/lib/eventdev/rte_event_eth_rx_adapter.c
> @@ -2773,6 +2773,11 @@ rte_event_eth_rx_adapter_queue_del(uint8_t id, uint16_t eth_dev_id,
>  		rx_adapter->eth_rx_poll = rx_poll;
>  		rx_adapter->wrr_sched = rx_wrr;
>  		rx_adapter->wrr_len = nb_wrr;
> +		/*
> +		 * reset next poll start position (wrr_pos) to avoid buffer
> +		 * overrun when wrr_len is reduced in case of queue delete
> +		 */
> +		rx_adapter->wrr_pos = 0;
>  		rx_adapter->num_intr_vec += num_intr_vec;
> 
>  		if (dev_info->nb_dev_queues == 0) {
> --
> 2.25.1
  

On Mon, Oct 18, 2021 at 4:39 PM Jayatheerthan, Jay
<jay.jayatheerthan@intel.com> wrote:
>
> Acked-by: Jay Jayatheerthan <jay.jayatheerthan@intel.com>


Changed the subject to:
eventdev/rx_adapter: fix WRR buffer overrun issue
Cced stable@dpdk.org

Series applied to dpdk-next-net-eventdev/for-main. Thanks

>
> > -----Original Message-----
> > From: Naga Harish K, S V <s.v.naga.harish.k@intel.com>
> > Sent: Monday, October 18, 2021 1:56 PM
> > To: jerinj@marvell.com; Jayatheerthan, Jay <jay.jayatheerthan@intel.com>
> > Cc: dev@dpdk.org
> > Subject: [PATCH] eventdev/rx_adapter: fix wrr buffer overrun issue
> >
> > when a poll queue is removed from a rx_adapter instance, the wrr poll
> > array is recomputed. The wrr array length is reduced in this case. The
> > next wrr position to poll is stored in wrr_pos variable of rx_adapter
> > instance. This wrr_pos can become invalid in some cases after wrr is
> > recomputed. Using this variable to get the next queue and device pair
> > may leed to wrr buffer overruns.
> >
> > Resetting the wrr_pos to zero after recomputation of wrr array fixes
> > the buffer overrun issue.
> >
> > Fixes: 9c38b704d280 ("eventdev: add eth Rx adapter implementation")
> >
> > Signed-off-by: Naga Harish K S V <s.v.naga.harish.k@intel.com>
> > ---
> >  lib/eventdev/rte_event_eth_rx_adapter.c | 5 +++++
> >  1 file changed, 5 insertions(+)
> >
> > diff --git a/lib/eventdev/rte_event_eth_rx_adapter.c b/lib/eventdev/rte_event_eth_rx_adapter.c
> > index bd68b8efe1..82a652d305 100644
> > --- a/lib/eventdev/rte_event_eth_rx_adapter.c
> > +++ b/lib/eventdev/rte_event_eth_rx_adapter.c
> > @@ -2773,6 +2773,11 @@ rte_event_eth_rx_adapter_queue_del(uint8_t id, uint16_t eth_dev_id,
> >               rx_adapter->eth_rx_poll = rx_poll;
> >               rx_adapter->wrr_sched = rx_wrr;
> >               rx_adapter->wrr_len = nb_wrr;
> > +             /*
> > +              * reset next poll start position (wrr_pos) to avoid buffer
> > +              * overrun when wrr_len is reduced in case of queue delete
> > +              */
> > +             rx_adapter->wrr_pos = 0;
> >               rx_adapter->num_intr_vec += num_intr_vec;
> >
> >               if (dev_info->nb_dev_queues == 0) {
> > --
> > 2.25.1
>