[dpdk-dev] [PATCH 5/7] net/hns3: fix crash when flushing RSS flow rules with FLR

["Wei Hu (Xavier)" <huwei013@chinasoftinc.com>]

From: Chengwen Feng <fengchengwen@huawei.com>

Currently, we encoutner segmentation fault when performing the following
test case:
1. Run testpmd application, config the flow filter rules then flush them
   repeatedly.
2. Inject FLR concurrently every 5 second.
The calltrace info:

This GDB was configured as "aarch64-linux-gnu".
Reading symbols from ./testpmd...(no debugging symbols found)...done.
[New LWP 322]
[New LWP 325]
[New LWP 324]
[New LWP 326]
[New LWP 323]
[New LWP 327]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/aarch64-linux-gnu/
libthread_db.so.1".
Core was generated by `/home/root/app/testpmd -w 0000:00:01.0 -w
0000:00:02.0 -w 0000:00:03.0 -l 0-3 -'.
Program terminated with signal SIGSEGV, Segmentation fault.
libc.so.6
[Current thread is 1 (Thread 0xffff8bb35110 (LWP 322))]
(gdb) bt
 #0  0x0000ffff8b936a90 in strlen () from /lib/aarch64-linux-gnu/
 libc.so.6
 #1  0x0000ffff8b905ccc in vfprintf () from /lib/aarch64-linux-gnu/
 libc.so.6
 #2  0x0000ffff8b993d04 in __printf_chk () from /lib/aarch64-linux-gnu/
 libc.so.6
 #3  0x0000000000754828 in port_flow_flush ()
 #4  0x0000000000870f3c in cmdline_parse ()

The root cause as follows：
In the '.flush' ops implementation function named hns3_flow_flush, By the
way the '.flush' ops is defined in the struct rte_flow_ops, if failed to
call hns3_clear_rss_filter, the out parameter error is not setted, and then
the member variable name message in the struct error is invalid(filled with
0x44444444 in port_flow_flush function of the testpmd application), it
leads to segmentation fault when format the message.

We fixes it by filling error parameter when failure in calling static
function named hns3_clear_rss_filter in the the '.flush' ops implementation
function named hns3_flow_flush.

Fixes: c37ca66f2b27 ("net/hns3: support RSS")
Cc: stable@dpdk.org

Signed-off-by: Chengwen Feng <fengchengwen@huawei.com>
Signed-off-by: Wei Hu (Xavier) <xavier.huwei@huawei.com>
---
 drivers/net/hns3/hns3_flow.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/net/hns3/hns3_flow.c b/drivers/net/hns3/hns3_flow.c
index 98affa567..559b9d02b 100644
--- a/drivers/net/hns3/hns3_flow.c
+++ b/drivers/net/hns3/hns3_flow.c
@@ -1827,8 +1827,11 @@ hns3_flow_flush(struct rte_eth_dev *dev, struct rte_flow_error *error)
 	}
 
 	ret = hns3_clear_rss_filter(dev);
-	if (ret)
+	if (ret) {
+		rte_flow_error_set(error, ret, RTE_FLOW_ERROR_TYPE_HANDLE,
+				   NULL, "Failed to flush rss filter");
 		return ret;
+	}
 
 	hns3_filterlist_flush(dev);
 
-- 
2.23.0