[v3] net/virtio: fix crash when dev is configured twice
Checks
Commit Message
When first attempt to configure a device with RX interrupt enabled fails
for some reason (e.g. because "Multiple intr vector not supported"),
second attempt to configure the device with RX interrupt disabled and
feature set unchanged will succeed but will leave virtio queues not
allocated. Accessing the queues will cause a segfault.
First attempt:
- virtio_dev_configure()
- virtio_init_device() is called to reinit the device because
"dev->data->dev_conf.intr_conf.rxq" is "1"
- virtio_configure_intr() fails and returns an error
- virtio_free_queues() frees previously allocated virtio queues
- virtio_init_device() fails and returns an error
- virtio_dev_configure() fails and returns an error
Second attempt:
- virtio_dev_configure()
- This time virtio_init_device() is not called, virtio queues
are not allocated
With this fix, reinit the device during configuration if virtio queues
are not allocated.
Fixes: 2b38151f745a ("net/virtio: fix queue memory leak on error")
Cc: stable@dpdk.org
Signed-off-by: Alexander Chernavin <achernavin@netgate.com>
---
v2: Add Cc: stable@dpdk.org
v3: Add Fixes: 2b38151f745a
drivers/net/virtio/virtio_ethdev.c | 7 +++++++
1 file changed, 7 insertions(+)
Comments
> -----Original Message-----
> From: Alexander Chernavin <achernavin@netgate.com>
> Sent: Tuesday, September 27, 2022 6:15 PM
> To: Xia, Chenbo <chenbo.xia@intel.com>; maxime.coquelin@redhat.com
> Cc: dev@dpdk.org; Alexander Chernavin <achernavin@netgate.com>;
> stable@dpdk.org
> Subject: [PATCH v3] net/virtio: fix crash when dev is configured twice
>
> When first attempt to configure a device with RX interrupt enabled fails
> for some reason (e.g. because "Multiple intr vector not supported"),
> second attempt to configure the device with RX interrupt disabled and
> feature set unchanged will succeed but will leave virtio queues not
> allocated. Accessing the queues will cause a segfault.
>
> First attempt:
> - virtio_dev_configure()
> - virtio_init_device() is called to reinit the device because
> "dev->data->dev_conf.intr_conf.rxq" is "1"
> - virtio_configure_intr() fails and returns an error
> - virtio_free_queues() frees previously allocated virtio queues
> - virtio_init_device() fails and returns an error
> - virtio_dev_configure() fails and returns an error
>
> Second attempt:
> - virtio_dev_configure()
> - This time virtio_init_device() is not called, virtio queues
> are not allocated
>
> With this fix, reinit the device during configuration if virtio queues
> are not allocated.
>
> Fixes: 2b38151f745a ("net/virtio: fix queue memory leak on error")
> Cc: stable@dpdk.org
>
> Signed-off-by: Alexander Chernavin <achernavin@netgate.com>
> ---
> v2: Add Cc: stable@dpdk.org
> v3: Add Fixes: 2b38151f745a
>
> drivers/net/virtio/virtio_ethdev.c | 7 +++++++
> 1 file changed, 7 insertions(+)
>
> diff --git a/drivers/net/virtio/virtio_ethdev.c
> b/drivers/net/virtio/virtio_ethdev.c
> index d180162abd..38bfe050b5 100644
> --- a/drivers/net/virtio/virtio_ethdev.c
> +++ b/drivers/net/virtio/virtio_ethdev.c
> @@ -2616,6 +2616,13 @@ virtio_dev_configure(struct rte_eth_dev *dev)
> return ret;
> }
>
> + /* if queues are not allocated, reinit the device */
> + if (hw->vqs == NULL) {
> + ret = virtio_init_device(dev, hw->req_guest_features);
> + if (ret < 0)
> + return ret;
> + }
> +
> if ((rxmode->mq_mode & RTE_ETH_MQ_RX_RSS_FLAG) &&
> !virtio_with_feature(hw, VIRTIO_NET_F_RSS)) {
> PMD_DRV_LOG(ERR, "RSS support requested but not supported by
> the device");
> --
> 2.25.1
Reviewed-by: Chenbo Xia <chenbo.xia@intel.com>
> -----Original Message-----
> From: Xia, Chenbo <chenbo.xia@intel.com>
> Sent: Wednesday, September 28, 2022 12:47 PM
> To: Alexander Chernavin <achernavin@netgate.com>;
> maxime.coquelin@redhat.com
> Cc: dev@dpdk.org; stable@dpdk.org
> Subject: RE: [PATCH v3] net/virtio: fix crash when dev is configured twice
>
> > -----Original Message-----
> > From: Alexander Chernavin <achernavin@netgate.com>
> > Sent: Tuesday, September 27, 2022 6:15 PM
> > To: Xia, Chenbo <chenbo.xia@intel.com>; maxime.coquelin@redhat.com
> > Cc: dev@dpdk.org; Alexander Chernavin <achernavin@netgate.com>;
> > stable@dpdk.org
> > Subject: [PATCH v3] net/virtio: fix crash when dev is configured twice
> >
> > When first attempt to configure a device with RX interrupt enabled fails
> > for some reason (e.g. because "Multiple intr vector not supported"),
> > second attempt to configure the device with RX interrupt disabled and
> > feature set unchanged will succeed but will leave virtio queues not
> > allocated. Accessing the queues will cause a segfault.
> >
> > First attempt:
> > - virtio_dev_configure()
> > - virtio_init_device() is called to reinit the device because
> > "dev->data->dev_conf.intr_conf.rxq" is "1"
> > - virtio_configure_intr() fails and returns an error
> > - virtio_free_queues() frees previously allocated virtio queues
> > - virtio_init_device() fails and returns an error
> > - virtio_dev_configure() fails and returns an error
> >
> > Second attempt:
> > - virtio_dev_configure()
> > - This time virtio_init_device() is not called, virtio queues
> > are not allocated
> >
> > With this fix, reinit the device during configuration if virtio queues
> > are not allocated.
> >
> > Fixes: 2b38151f745a ("net/virtio: fix queue memory leak on error")
> > Cc: stable@dpdk.org
> >
> > Signed-off-by: Alexander Chernavin <achernavin@netgate.com>
> > ---
> > v2: Add Cc: stable@dpdk.org
> > v3: Add Fixes: 2b38151f745a
> >
> > drivers/net/virtio/virtio_ethdev.c | 7 +++++++
> > 1 file changed, 7 insertions(+)
> >
> > diff --git a/drivers/net/virtio/virtio_ethdev.c
> > b/drivers/net/virtio/virtio_ethdev.c
> > index d180162abd..38bfe050b5 100644
> > --- a/drivers/net/virtio/virtio_ethdev.c
> > +++ b/drivers/net/virtio/virtio_ethdev.c
> > @@ -2616,6 +2616,13 @@ virtio_dev_configure(struct rte_eth_dev *dev)
> > return ret;
> > }
> >
> > + /* if queues are not allocated, reinit the device */
> > + if (hw->vqs == NULL) {
> > + ret = virtio_init_device(dev, hw->req_guest_features);
> > + if (ret < 0)
> > + return ret;
> > + }
> > +
> > if ((rxmode->mq_mode & RTE_ETH_MQ_RX_RSS_FLAG) &&
> > !virtio_with_feature(hw, VIRTIO_NET_F_RSS)) {
> > PMD_DRV_LOG(ERR, "RSS support requested but not supported by
> > the device");
> > --
> > 2.25.1
>
> Reviewed-by: Chenbo Xia <chenbo.xia@intel.com>
Applied to next-virtio/main, thanks
@@ -2616,6 +2616,13 @@ virtio_dev_configure(struct rte_eth_dev *dev)
return ret;
}
+ /* if queues are not allocated, reinit the device */
+ if (hw->vqs == NULL) {
+ ret = virtio_init_device(dev, hw->req_guest_features);
+ if (ret < 0)
+ return ret;
+ }
+
if ((rxmode->mq_mode & RTE_ETH_MQ_RX_RSS_FLAG) &&
!virtio_with_feature(hw, VIRTIO_NET_F_RSS)) {
PMD_DRV_LOG(ERR, "RSS support requested but not supported by the device");