From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-wm0-f51.google.com (mail-wm0-f51.google.com [74.125.82.51]) by dpdk.org (Postfix) with ESMTP id E6A123977 for ; Tue, 2 Aug 2016 14:33:03 +0200 (CEST) Received: by mail-wm0-f51.google.com with SMTP id f65so407250704wmi.0 for ; Tue, 02 Aug 2016 05:33:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=6wind-com.20150623.gappssmtp.com; s=20150623; h=date:from:to:cc:subject:message-id:mail-followup-to:references :mime-version:content-disposition:in-reply-to; bh=iNzo9yPg78KvsUcLK7/fqR2UO7kNuT5f1svRnCS8WaE=; b=qGTuFSzVXUEzpROBdWU6+vHcJJLLEN94RZQess8p/lyIKhoTiaJmLtvpQfdyNes1BV VZSOR9qYBeWAeZ9SXn1g1ZIX6aZ40ztdMy2eNvZ9goJgDpqp99xQnwCeRQBMrMTmqHzO 0+6tDVuQIahzBw+6l/Df9QA8VRZcN6e93Qe99Dd0HtKDohhXZrYtX6G3bHle0+n1k8bf gy8EVHMeLrKf4EkS5HtAHr4nynUfCcnpEdFVPfYx+n5tvCurRhcHB4E58/+yyvM68OF3 HLK/fdIbNWavEYmfxs5r3zunA4vGSpRw6UZrwuFs99DMJREEIMNT4UEoF0h86YUQ4Emy 8iaA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:date:from:to:cc:subject:message-id :mail-followup-to:references:mime-version:content-disposition :in-reply-to; bh=iNzo9yPg78KvsUcLK7/fqR2UO7kNuT5f1svRnCS8WaE=; b=GPvgu/zmyrFq5DVGm9lEW1k3YVGx4yLWU0l4xe1c30DzSco7sjOuSjUN5aIDsSmqhw wafk3FCbNdqC9xNA2LH3LkiTZUt8EzwqHZ2A7sgKfNDVYp6xaObzi5LgHjtYPt/uJ9Ej uPNpIBspf6TFIuKlC1VoEP1+yd7OW9fAr3KO0vpuVB2r0QIGicSmN/O3dHkzZBY279hG z9xRcoGgYDOvE7oTdhySpN7I7ZpaZsPUYbBZypA2sEO2Yunr3I2aj0cSUOPsCJSnuUOj LMkjLvJnR6NisWZiOf2TcpX0bzto4Dw3Bjio1lMX0liN30OhYkb35xoynxGfzuNgQ0m1 3yLA== X-Gm-Message-State: AEkoousILaQjSdYuGkB3yBvMHsBxAX4v/MqE+FpSEpFecTeZ4Skbwd4VKjQ23mI0P8oVsCtu X-Received: by 10.194.114.103 with SMTP id jf7mr60854652wjb.172.1470141183627; Tue, 02 Aug 2016 05:33:03 -0700 (PDT) Received: from 6wind.com (guy78-3-82-239-227-177.fbx.proxad.net. [82.239.227.177]) by smtp.gmail.com with ESMTPSA id q186sm23389408wma.1.2016.08.02.05.33.02 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 02 Aug 2016 05:33:02 -0700 (PDT) Date: Tue, 2 Aug 2016 14:32:59 +0200 From: Adrien Mazarguil To: Sagi Grimberg Cc: dev@dpdk.org Message-ID: <20160802123258.GE30580@6wind.com> Mail-Followup-To: Sagi Grimberg , dev@dpdk.org References: <1470139338-7012-1-git-send-email-sagi@grimberg.me> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1470139338-7012-1-git-send-email-sagi@grimberg.me> Subject: Re: [dpdk-dev] [PATCH v2] net/mlx5: Fix possible NULL deref in RX path X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: patches and discussions about DPDK List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 02 Aug 2016 12:33:04 -0000 On Tue, Aug 02, 2016 at 03:02:18PM +0300, Sagi Grimberg wrote: > The user is allowed to call ->rx_pkt_burst() even without free > mbufs in the pool. In this scenario we'll fail allocating a rep mbuf > on the first iteration (where pkt is still NULL). This would cause us > to deref a NULL pkt (reset refcount and free). > > Fix this by checking the pkt before freeing it. > > Fixes: a1bdb71a32da ("net/mlx5: fix crash in Rx") > Signed-off-by: Sagi Grimberg > --- > Changes from v1: > - check pkt only once in case we failed to allocate a buffer > > drivers/net/mlx5/mlx5_rxtx.c | 9 ++++++++- > 1 file changed, 8 insertions(+), 1 deletion(-) > > diff --git a/drivers/net/mlx5/mlx5_rxtx.c b/drivers/net/mlx5/mlx5_rxtx.c > index fce3381ae87a..37573668e43e 100644 > --- a/drivers/net/mlx5/mlx5_rxtx.c > +++ b/drivers/net/mlx5/mlx5_rxtx.c > @@ -1572,6 +1572,14 @@ mlx5_rx_burst(void *dpdk_rxq, struct rte_mbuf **pkts, uint16_t pkts_n) > rte_prefetch0(wqe); > rep = rte_mbuf_raw_alloc(rxq->mp); > if (unlikely(rep == NULL)) { > + ++rxq->stats.rx_nombuf; > + if (!pkt) { > + /* > + * no buffers before we even started, > + * bail out silently. > + */ > + break; > + } > while (pkt != seg) { > assert(pkt != (*rxq->elts)[idx]); > seg = NEXT(pkt); > @@ -1579,7 +1587,6 @@ mlx5_rx_burst(void *dpdk_rxq, struct rte_mbuf **pkts, uint16_t pkts_n) > __rte_mbuf_raw_free(pkt); > pkt = seg; > } > - ++rxq->stats.rx_nombuf; > break; > } > if (!pkt) { > -- > 1.9.1 A few nit-picks from check-git-log.sh: Wrong headline uppercase: net/mlx5: Fix possible NULL deref in RX path Wrong headline lowercase: net/mlx5: Fix possible NULL deref in RX path Missing blank line after 'Fixes' tag: Fixes: a1bdb71a32da ("net/mlx5: fix crash in Rx") Otherwise, Acked-by: Adrien Mazarguil -- Adrien Mazarguil 6WIND