From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 58E7545C78; Mon, 4 Nov 2024 17:16:21 +0100 (CET) Received: from mails.dpdk.org (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 39B5640E26; Mon, 4 Nov 2024 17:16:21 +0100 (CET) Received: from NAM10-DM6-obe.outbound.protection.outlook.com (mail-dm6nam10on2067.outbound.protection.outlook.com [40.107.93.67]) by mails.dpdk.org (Postfix) with ESMTP id AC5D540279; Mon, 4 Nov 2024 17:16:19 +0100 (CET) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=SqxGgEPfbpPQiPkBTCYHgLZl6nI10XXiprIDTne/0HcW9k0VX840xcosQb7IG7nPsmSMMu/v58+QxfQPXfCTIiR7nX79U6M2ZfTQemW3iKc+cIicw31xVQJMWYLJA62qmilHLYO9UqQuizOhjg4amhHJgDHhkHhFCUFJa4JS1U/ulr7zUIoTvv+j2Zr0zqbwZJ+Wf7jtkk9FNBsBPWL549GwsggMnaWjzBzXDNuzfGsqqhmu+bO3t6qw6fAnfdI3WbO5cydA0tRrUBjy20My+xv8VCK6ZOOrqn2PuaxOOpyzyhE0aiUd1MBq4NMsVqc6nBj6C4MGgEQnII+nQ7+MtA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=PcmH5y0Klne8EIJ4nTyRnUFZcNE+dALbSEZCZYfFFdM=; b=n6qYcp8tKdq4UDzGFe/6hPdtmAJFipo709LHKO6UEeb3v8iB/K/2R/OLD4UnOpOrlbXiYppS8uN4PysFl3wEsus5wcXH6fjeja3FRgDgEXlef6zbRusmV91uZZElqTf09cPPYoUr/8hMK+CVgXy3dg3x9WmmzSuTqvBaPNOIM4XwP6HihgjJTs/gaI3T/wPq1f6KScyUk5VJvc050ziLumR6kzg1WJu/MP34cWWF7RG1XslB7zl41ElwEERUrwtSNR3bD3P1AsXKBRBYqsPJvR6KrNqc7T8zBSyc3fPvMLgAuqubOe8t2y/HAZ4zn6HrL1UhckWgHmeqRqOKYenXog== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.117.160) smtp.rcpttodomain=dpdk.org smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=PcmH5y0Klne8EIJ4nTyRnUFZcNE+dALbSEZCZYfFFdM=; b=aT4R2URAC7nw1FGWRY7V5gS8PwYT0dIcY5BTHsVK8wj7DHluLy9Co4gJesCzUSY/f4Z6jMovAuYlHSQauBSB0VKe7sPwl0oXXeEo67IKxdO/u12ALUJHjxLIU2rwN25wIcx3StHJYzSORWbbf4qV9QTnv+4pymz1HQMJrk0aEAiYBucfjiss5WKiwWPVcbInN6ZnTWokcCBINUc4Z6gvsRAoDkIGqEyzgK866vZdruslwxnF/r8ojd1AJpv4dGpZxLT9TNUrCteWA/FRLjBnfDOSNyBogJJdjYGMZ/gwx2c6K9QWLwob/NjSj2Uj5nSnYwl964LWw26xmgDu2CdfHA== Received: from MW4PR03CA0203.namprd03.prod.outlook.com (2603:10b6:303:b8::28) by MW4PR12MB7287.namprd12.prod.outlook.com (2603:10b6:303:22c::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8114.30; Mon, 4 Nov 2024 16:16:16 +0000 Received: from SJ1PEPF000023DA.namprd21.prod.outlook.com (2603:10b6:303:b8:cafe::e9) by MW4PR03CA0203.outlook.office365.com (2603:10b6:303:b8::28) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8093.37 via Frontend Transport; Mon, 4 Nov 2024 16:16:16 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.117.160) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.117.160 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.117.160; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.117.160) by SJ1PEPF000023DA.mail.protection.outlook.com (10.167.244.75) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8158.0 via Frontend Transport; Mon, 4 Nov 2024 16:16:16 +0000 Received: from rnnvmail201.nvidia.com (10.129.68.8) by mail.nvidia.com (10.129.200.66) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.4; Mon, 4 Nov 2024 08:15:59 -0800 Received: from nvidia.com (10.126.230.35) by rnnvmail201.nvidia.com (10.129.68.8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.4; Mon, 4 Nov 2024 08:15:56 -0800 From: Bing Zhao To: , , , CC: , , , Subject: [PATCH] net/mlx5: fix the Rx queue control management Date: Mon, 4 Nov 2024 18:15:41 +0200 Message-ID: <20241104161541.255086-1-bingz@nvidia.com> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain X-Originating-IP: [10.126.230.35] X-ClientProxiedBy: rnnvmail203.nvidia.com (10.129.68.9) To rnnvmail201.nvidia.com (10.129.68.8) X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: SJ1PEPF000023DA:EE_|MW4PR12MB7287:EE_ X-MS-Office365-Filtering-Correlation-Id: b271b90d-07c5-4a9f-f915-08dcfcec0248 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; ARA:13230040|376014|1800799024|82310400026|36860700013; X-Microsoft-Antispam-Message-Info: =?us-ascii?Q?MiNcXdGXBy+OD7U599d63aLnflisEk/m5zfNlh/E0Bj/3ahKQy+WiFQyK+e2?= =?us-ascii?Q?mfKikenNfUUdlVGy+jTO6gFyWhnB7KpX6cR9GymofR2/vJ7FxaRc40sSfdTC?= =?us-ascii?Q?+mg4HWPDPB6vZy2ApqxFVybw9xE7sD4983pha+IIfiobQhk8z5y4JmJCdOKJ?= =?us-ascii?Q?PFepdFEbxz33tMeaTSNrh/rVbI4qYL3U0qQSVHyjgw3N/x0BAXNj8c5TjWs2?= =?us-ascii?Q?SnhIzk2DN3zSwZqHeCkzTSL341fnqtyhwMl4hetySu/XuOb6BtFMr7nZp1PU?= =?us-ascii?Q?JBrXgd7vDIsMsMPH6IdCHDOhp5Z1a2iKaHp3Jy/wWAktrlpuF9V9Ywkv+8Ya?= =?us-ascii?Q?QAcTGfOB8PnI6/0IlhoyPScJtv6ogbx9wnJpo51AjlXhUSqX482WMZ49wVkN?= =?us-ascii?Q?7bw5x8tWZQoZA89qV+GzK1OMcB+mcyic9hCGckp1Sj9KaDMBj35kvqQ0kbGg?= =?us-ascii?Q?s6MAl5Tkbt3GOXqIHo1dvKxPOhDN1n4tR33fOKIr+XHGaOeONaO0Mkrz11rb?= =?us-ascii?Q?cXtFXfhJxrsLTQpMxw42wsdiy3PZ1mMb+BS12sJ/Iv0BjdvmjPyY2MywMevT?= =?us-ascii?Q?ecWt7bsT6UlSXqpfrmEiSz46KattryqIv9fLRaVGRrhdexSdD61i5pcMmDrV?= =?us-ascii?Q?IBfFjvnytuUTooTU8ffojsvC7ZdvdjNYKDtlUGZYPSPSOrd3f/gGca4LWWxQ?= =?us-ascii?Q?fs0yF08HyQR5dJkkXnu6nWn3FiWCRVwWjM122kTepGBdrhKhsa50mwx1APag?= =?us-ascii?Q?6BLAeqAmUkBVgxswtuwx6+m8UI+rFveCywRQNk9B1mw5JzHtIYBeyEJeC5Zc?= =?us-ascii?Q?1nO8xqpN/qrMW576kLKKkGrViLJ9crMX9EqxMKKFnFyk/ZlKyxmIrgzmWNAh?= =?us-ascii?Q?EYQR5Tw6azGAeK0Ja/wj6SIRBKDXeoD5FrOfqgiw8K9hM0B2LICQ7nIsaunl?= =?us-ascii?Q?vhsnB+InjZYlMDXVSApqqYLzpryX1cYJvsc/2oWHB9upBVqGhicBOzmhHyVf?= =?us-ascii?Q?FJk2A0PH9w2rHeuTwGgl4GRARR9R2FxpZMxJOBZbnLlmFOcGLXxewLZ4LDmj?= =?us-ascii?Q?txTDPaBj0p8M+ZSpW7fpSB5oANiY4J900jOyx/qq3YOcXRM2S4erdPcFdQEe?= =?us-ascii?Q?UkBqwSgWDbBI2pPbeATz44Uo5UQrYxzX1i6KWZBVVJBfFhEQRd9y2yQLn1qr?= =?us-ascii?Q?1kcKOQsVVbORNPh8IKcnhCJpcPzlqu9MNfakXGSG4nQCxmp1jzM8Bvn37htq?= =?us-ascii?Q?Usm0SLsxpqWDQdoOOeehJSPMiLZcNUF0TBCCZoql5NeFs2hNWALoFIyVa7TZ?= =?us-ascii?Q?ET+cSdHK6pEy7qY2EgcP7Uy6/Tdn1eTEiTVyZtCHSKH5lZQ+VzG+TJuKPtWi?= =?us-ascii?Q?gM9HLbjpaLDmtYn0v4l4eIcOET+QDOk+dYlD1IjxIqXIBUgJqg=3D=3D?= X-Forefront-Antispam-Report: CIP:216.228.117.160; CTRY:US; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:mail.nvidia.com; PTR:dc6edge1.nvidia.com; CAT:NONE; SFS:(13230040)(376014)(1800799024)(82310400026)(36860700013); DIR:OUT; SFP:1101; X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 04 Nov 2024 16:16:16.0273 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: b271b90d-07c5-4a9f-f915-08dcfcec0248 X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a; Ip=[216.228.117.160]; Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: SJ1PEPF000023DA.namprd21.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW4PR12MB7287 X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org With the shared Rx queue feature introduced, the control and private Rx queue structures are decoupled, each control structure can be shared for multiple queue for all representors inside a domain. So it should be only managed by the shared context instead of any private data of each device. The previous workaround is using a flag to check the owner (allocator) of the structure and handle it only on that device closing stage. A proper formal solution is to add a reference count for each control structure and only free the structure when there is no reference to it to get rid of the UAF issue. Fixes: f957ac996435 ("net/mlx5: workaround list management of Rx queue control") Fixes: bcc220cb57d7 ("net/mlx5: fix shared Rx queue list management") CC: stable@dpdk.org Signed-off-by: Bing Zhao Acked-by: Viacheslav Ovsiienko Acked-by: Dariusz Sosnowski --- drivers/net/mlx5/mlx5.h | 1 - drivers/net/mlx5/mlx5_flow.c | 4 ++-- drivers/net/mlx5/mlx5_rx.h | 3 +-- drivers/net/mlx5/mlx5_rxq.c | 20 ++++++++++---------- 4 files changed, 13 insertions(+), 15 deletions(-) diff --git a/drivers/net/mlx5/mlx5.h b/drivers/net/mlx5/mlx5.h index b6be4646ef..6db02da3b8 100644 --- a/drivers/net/mlx5/mlx5.h +++ b/drivers/net/mlx5/mlx5.h @@ -1978,7 +1978,6 @@ struct mlx5_priv { uint32_t ctrl_flows; /* Control flow rules. */ rte_spinlock_t flow_list_lock; struct mlx5_obj_ops obj_ops; /* HW objects operations. */ - LIST_HEAD(rxq, mlx5_rxq_ctrl) rxqsctrl; /* DPDK Rx queues. */ LIST_HEAD(rxqobj, mlx5_rxq_obj) rxqsobj; /* Verbs/DevX Rx queues. */ struct mlx5_list *hrxqs; /* Hash Rx queues. */ LIST_HEAD(txq, mlx5_txq_ctrl) txqsctrl; /* DPDK Tx queues. */ diff --git a/drivers/net/mlx5/mlx5_flow.c b/drivers/net/mlx5/mlx5_flow.c index 9c43201e05..acae2bb063 100644 --- a/drivers/net/mlx5/mlx5_flow.c +++ b/drivers/net/mlx5/mlx5_flow.c @@ -1648,13 +1648,13 @@ flow_rxq_mark_flag_set(struct rte_eth_dev *dev) opriv->domain_id != priv->domain_id || opriv->mark_enabled) continue; - LIST_FOREACH(rxq_ctrl, &opriv->rxqsctrl, next) { + LIST_FOREACH(rxq_ctrl, &opriv->sh->shared_rxqs, share_entry) { rxq_ctrl->rxq.mark = 1; } opriv->mark_enabled = 1; } } else { - LIST_FOREACH(rxq_ctrl, &priv->rxqsctrl, next) { + LIST_FOREACH(rxq_ctrl, &priv->sh->shared_rxqs, share_entry) { rxq_ctrl->rxq.mark = 1; } priv->mark_enabled = 1; diff --git a/drivers/net/mlx5/mlx5_rx.h b/drivers/net/mlx5/mlx5_rx.h index 9bcb43b007..da7c448948 100644 --- a/drivers/net/mlx5/mlx5_rx.h +++ b/drivers/net/mlx5/mlx5_rx.h @@ -151,13 +151,13 @@ struct __rte_cache_aligned mlx5_rxq_data { /* RX queue control descriptor. */ struct mlx5_rxq_ctrl { struct mlx5_rxq_data rxq; /* Data path structure. */ - LIST_ENTRY(mlx5_rxq_ctrl) next; /* Pointer to the next element. */ LIST_HEAD(priv, mlx5_rxq_priv) owners; /* Owner rxq list. */ struct mlx5_rxq_obj *obj; /* Verbs/DevX elements. */ struct mlx5_dev_ctx_shared *sh; /* Shared context. */ bool is_hairpin; /* Whether RxQ type is Hairpin. */ unsigned int socket; /* CPU socket ID for allocations. */ LIST_ENTRY(mlx5_rxq_ctrl) share_entry; /* Entry in shared RXQ list. */ + RTE_ATOMIC(uint32_t) ctrl_ref; /* Reference counter. */ uint32_t share_group; /* Group ID of shared RXQ. */ uint16_t share_qid; /* Shared RxQ ID in group. */ unsigned int started:1; /* Whether (shared) RXQ has been started. */ @@ -173,7 +173,6 @@ struct mlx5_rxq_ctrl { /* RX queue private data. */ struct mlx5_rxq_priv { uint16_t idx; /* Queue index. */ - bool possessor; /* Shared rxq_ctrl allocated for the 1st time. */ RTE_ATOMIC(uint32_t) refcnt; /* Reference counter. */ struct mlx5_rxq_ctrl *ctrl; /* Shared Rx Queue. */ LIST_ENTRY(mlx5_rxq_priv) owner_entry; /* Entry in shared rxq_ctrl. */ diff --git a/drivers/net/mlx5/mlx5_rxq.c b/drivers/net/mlx5/mlx5_rxq.c index 5eac224b76..d437835b73 100644 --- a/drivers/net/mlx5/mlx5_rxq.c +++ b/drivers/net/mlx5/mlx5_rxq.c @@ -946,7 +946,6 @@ mlx5_rx_queue_setup(struct rte_eth_dev *dev, uint16_t idx, uint16_t desc, rte_errno = ENOMEM; return -rte_errno; } - rxq->possessor = true; } rxq->priv = priv; rxq->idx = idx; @@ -954,6 +953,7 @@ mlx5_rx_queue_setup(struct rte_eth_dev *dev, uint16_t idx, uint16_t desc, /* Join owner list. */ LIST_INSERT_HEAD(&rxq_ctrl->owners, rxq, owner_entry); rxq->ctrl = rxq_ctrl; + rte_atomic_fetch_add_explicit(&rxq_ctrl->ctrl_ref, 1, rte_memory_order_relaxed); mlx5_rxq_ref(dev, idx); DRV_LOG(DEBUG, "port %u adding Rx queue %u to list", dev->data->port_id, idx); @@ -1970,9 +1970,9 @@ mlx5_rxq_new(struct rte_eth_dev *dev, uint16_t idx, uint16_t desc, tmpl->rxq.shared = 1; tmpl->share_group = conf->share_group; tmpl->share_qid = conf->share_qid; - LIST_INSERT_HEAD(&priv->sh->shared_rxqs, tmpl, share_entry); } - LIST_INSERT_HEAD(&priv->rxqsctrl, tmpl, next); + LIST_INSERT_HEAD(&priv->sh->shared_rxqs, tmpl, share_entry); + rte_atomic_store_explicit(&tmpl->ctrl_ref, 1, rte_memory_order_relaxed); return tmpl; error: mlx5_mr_btree_free(&tmpl->rxq.mr_ctrl.cache_bh); @@ -2024,9 +2024,9 @@ mlx5_rxq_hairpin_new(struct rte_eth_dev *dev, struct mlx5_rxq_priv *rxq, tmpl->rxq.mr_ctrl.cache_bh = (struct mlx5_mr_btree) { 0 }; tmpl->rxq.idx = idx; rxq->hairpin_conf = *hairpin_conf; - rxq->possessor = true; mlx5_rxq_ref(dev, idx); - LIST_INSERT_HEAD(&priv->rxqsctrl, tmpl, next); + LIST_INSERT_HEAD(&priv->sh->shared_rxqs, tmpl, share_entry); + rte_atomic_store_explicit(&tmpl->ctrl_ref, 1, rte_memory_order_relaxed); return tmpl; } @@ -2292,16 +2292,16 @@ mlx5_rxq_release(struct rte_eth_dev *dev, uint16_t idx) RTE_ETH_QUEUE_STATE_STOPPED; } } else { /* Refcnt zero, closing device. */ - if (rxq->possessor) - LIST_REMOVE(rxq_ctrl, next); LIST_REMOVE(rxq, owner_entry); if (LIST_EMPTY(&rxq_ctrl->owners)) { if (!rxq_ctrl->is_hairpin) mlx5_mr_btree_free (&rxq_ctrl->rxq.mr_ctrl.cache_bh); - if (rxq_ctrl->rxq.shared) + if (rte_atomic_fetch_sub_explicit(&rxq_ctrl->ctrl_ref, 1, + rte_memory_order_relaxed) == 1) { LIST_REMOVE(rxq_ctrl, share_entry); - mlx5_free(rxq_ctrl); + mlx5_free(rxq_ctrl); + } } dev->data->rx_queues[idx] = NULL; mlx5_free(rxq); @@ -2326,7 +2326,7 @@ mlx5_rxq_verify(struct rte_eth_dev *dev) struct mlx5_rxq_ctrl *rxq_ctrl; int ret = 0; - LIST_FOREACH(rxq_ctrl, &priv->rxqsctrl, next) { + LIST_FOREACH(rxq_ctrl, &priv->sh->shared_rxqs, share_entry) { DRV_LOG(DEBUG, "port %u Rx Queue %u still referenced", dev->data->port_id, rxq_ctrl->rxq.idx); ++ret; -- 2.34.1