* [PATCH v2] eal: fix unused memseg length
@ 2025-01-02 7:26 Yang Ming
0 siblings, 0 replies; 4+ messages in thread
From: Yang Ming @ 2025-01-02 7:26 UTC (permalink / raw)
To: Anatoly Burakov; +Cc: dev, Yang Ming, stable, Dmitry Kozlyuk
Fix the issue where OS memory is mistakenly freed with rte_free
by setting the length (len) of unused memseg to 0.
When `eal_legacy_hugepage_init()` releases the VA space for
unused memseg lists(MSLs), it does not reset MSLs' length to 0.
As a result, `mlx5_mem_is_rte()` may incorrectly identify OS
memory as rte memory.
This can lead to `mlx_free()` calling `rte_free()` on OS memory,
causing an "EAL: Error: Invalid memory" log and failing to free
the OS memory.
This issue is occasional and occurs when the DPDK program’s
memory map places the heap address range between 0 and len(32G).
In such cases, malloc may return an address less than len,
causing `mlx5_mem_is_rte()` to incorrectly treat it as rte
memory.
Also, consider how the MSL with `base_va == NULL` ends up in
`mlx5_mem_is_rte()`. It comes from `rte_mem_virt2memseg_list()`
which iterates MSLs and checks that an address belongs to
[`base_va`; `base_va+len`) without checking whether
`base_va == NULL` i.e. that the MSL is inactive. So this patch
also corrects `rte_mem_virt2memseg_list()` behavior.
Fixes: 66cc45e293ed ("mem: replace memseg with memseg lists")
Cc: anatoly.burakov@intel.com
Cc: stable@dpdk.org
Signed-off-by: Yang Ming <ming.1.yang@nokia-sbell.com>
Acked-by: Dmitry Kozlyuk <dmitry.kozliuk@gmail.com>
---
lib/eal/linux/eal_memory.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/lib/eal/linux/eal_memory.c b/lib/eal/linux/eal_memory.c
index 45879ca743..9dda60c0e1 100644
--- a/lib/eal/linux/eal_memory.c
+++ b/lib/eal/linux/eal_memory.c
@@ -1472,6 +1472,7 @@ eal_legacy_hugepage_init(void)
mem_sz = msl->len;
munmap(msl->base_va, mem_sz);
msl->base_va = NULL;
+ msl->len = 0;
msl->heap = 0;
/* destroy backing fbarray */
--
2.34.1
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH v2] eal: fix unused memseg length
2025-01-02 8:58 ` [PATCH v2] eal: fix unused memseg length Yang Ming
2025-01-22 3:14 ` Yang Ming
@ 2025-02-07 14:41 ` David Marchand
1 sibling, 0 replies; 4+ messages in thread
From: David Marchand @ 2025-02-07 14:41 UTC (permalink / raw)
To: Yang Ming; +Cc: dev, anatoly.burakov, stable, Dmitry Kozlyuk
On Thu, Jan 2, 2025 at 9:59 AM Yang Ming <ming.1.yang@nokia-sbell.com> wrote:
>
> Fix the issue where OS memory is mistakenly freed with rte_free
> by setting the length (len) of unused memseg to 0.
>
> When `eal_legacy_hugepage_init()` releases the VA space for
> unused memseg lists(MSLs), it does not reset MSLs' length to 0.
> As a result, `mlx5_mem_is_rte()` may incorrectly identify OS
> memory as rte memory.
> This can lead to `mlx_free()` calling `rte_free()` on OS memory,
> causing an "EAL: Error: Invalid memory" log and failing to free
> the OS memory.
>
> This issue is occasional and occurs when the DPDK program’s
> memory map places the heap address range between 0 and len(32G).
> In such cases, malloc may return an address less than len,
> causing `mlx5_mem_is_rte()` to incorrectly treat it as rte
> memory.
>
> Also, consider how the MSL with `base_va == NULL` ends up in
> `mlx5_mem_is_rte()`. It comes from `rte_mem_virt2memseg_list()`
> which iterates MSLs and checks that an address belongs to
> [`base_va`; `base_va+len`) without checking whether
> `base_va == NULL` i.e. that the MSL is inactive. So this patch
> also corrects `rte_mem_virt2memseg_list()` behavior.
>
> Fixes: 66cc45e293ed ("mem: replace memseg with memseg lists")
> Cc: stable@dpdk.org
>
> Signed-off-by: Yang Ming <ming.1.yang@nokia-sbell.com>
> Acked-by: Dmitry Kozlyuk <dmitry.kozliuk@gmail.com>
Applied, thanks for the fix.
--
David Marchand
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH v2] eal: fix unused memseg length
2025-01-02 8:58 ` [PATCH v2] eal: fix unused memseg length Yang Ming
@ 2025-01-22 3:14 ` Yang Ming
2025-02-07 14:41 ` David Marchand
1 sibling, 0 replies; 4+ messages in thread
From: Yang Ming @ 2025-01-22 3:14 UTC (permalink / raw)
To: dev, Thomas Monjalon; +Cc: anatoly.burakov, stable, Dmitry Kozlyuk
Hi experts, is there any chance to review and accept this patch?
On 2025/1/2 16:58, Yang Ming wrote:
> Fix the issue where OS memory is mistakenly freed with rte_free
> by setting the length (len) of unused memseg to 0.
>
> When `eal_legacy_hugepage_init()` releases the VA space for
> unused memseg lists(MSLs), it does not reset MSLs' length to 0.
> As a result, `mlx5_mem_is_rte()` may incorrectly identify OS
> memory as rte memory.
> This can lead to `mlx_free()` calling `rte_free()` on OS memory,
> causing an "EAL: Error: Invalid memory" log and failing to free
> the OS memory.
>
> This issue is occasional and occurs when the DPDK program’s
> memory map places the heap address range between 0 and len(32G).
> In such cases, malloc may return an address less than len,
> causing `mlx5_mem_is_rte()` to incorrectly treat it as rte
> memory.
>
> Also, consider how the MSL with `base_va == NULL` ends up in
> `mlx5_mem_is_rte()`. It comes from `rte_mem_virt2memseg_list()`
> which iterates MSLs and checks that an address belongs to
> [`base_va`; `base_va+len`) without checking whether
> `base_va == NULL` i.e. that the MSL is inactive. So this patch
> also corrects `rte_mem_virt2memseg_list()` behavior.
>
> Fixes: 66cc45e293ed ("mem: replace memseg with memseg lists")
> Cc: anatoly.burakov@intel.com
> Cc: stable@dpdk.org
>
> Signed-off-by: Yang Ming <ming.1.yang@nokia-sbell.com>
> Acked-by: Dmitry Kozlyuk <dmitry.kozliuk@gmail.com>
> ---
> lib/eal/linux/eal_memory.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/lib/eal/linux/eal_memory.c b/lib/eal/linux/eal_memory.c
> index 45879ca743..9dda60c0e1 100644
> --- a/lib/eal/linux/eal_memory.c
> +++ b/lib/eal/linux/eal_memory.c
> @@ -1472,6 +1472,7 @@ eal_legacy_hugepage_init(void)
> mem_sz = msl->len;
> munmap(msl->base_va, mem_sz);
> msl->base_va = NULL;
> + msl->len = 0;
> msl->heap = 0;
>
> /* destroy backing fbarray */
^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH v2] eal: fix unused memseg length
2024-12-26 8:10 [PATCH] Fix unused memseg length for memory issue Yang Ming
@ 2025-01-02 8:58 ` Yang Ming
2025-01-22 3:14 ` Yang Ming
2025-02-07 14:41 ` David Marchand
0 siblings, 2 replies; 4+ messages in thread
From: Yang Ming @ 2025-01-02 8:58 UTC (permalink / raw)
To: dev; +Cc: Yang Ming, anatoly.burakov, stable, Dmitry Kozlyuk
Fix the issue where OS memory is mistakenly freed with rte_free
by setting the length (len) of unused memseg to 0.
When `eal_legacy_hugepage_init()` releases the VA space for
unused memseg lists(MSLs), it does not reset MSLs' length to 0.
As a result, `mlx5_mem_is_rte()` may incorrectly identify OS
memory as rte memory.
This can lead to `mlx_free()` calling `rte_free()` on OS memory,
causing an "EAL: Error: Invalid memory" log and failing to free
the OS memory.
This issue is occasional and occurs when the DPDK program’s
memory map places the heap address range between 0 and len(32G).
In such cases, malloc may return an address less than len,
causing `mlx5_mem_is_rte()` to incorrectly treat it as rte
memory.
Also, consider how the MSL with `base_va == NULL` ends up in
`mlx5_mem_is_rte()`. It comes from `rte_mem_virt2memseg_list()`
which iterates MSLs and checks that an address belongs to
[`base_va`; `base_va+len`) without checking whether
`base_va == NULL` i.e. that the MSL is inactive. So this patch
also corrects `rte_mem_virt2memseg_list()` behavior.
Fixes: 66cc45e293ed ("mem: replace memseg with memseg lists")
Cc: anatoly.burakov@intel.com
Cc: stable@dpdk.org
Signed-off-by: Yang Ming <ming.1.yang@nokia-sbell.com>
Acked-by: Dmitry Kozlyuk <dmitry.kozliuk@gmail.com>
---
lib/eal/linux/eal_memory.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/lib/eal/linux/eal_memory.c b/lib/eal/linux/eal_memory.c
index 45879ca743..9dda60c0e1 100644
--- a/lib/eal/linux/eal_memory.c
+++ b/lib/eal/linux/eal_memory.c
@@ -1472,6 +1472,7 @@ eal_legacy_hugepage_init(void)
mem_sz = msl->len;
munmap(msl->base_va, mem_sz);
msl->base_va = NULL;
+ msl->len = 0;
msl->heap = 0;
/* destroy backing fbarray */
--
2.34.1
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2025-02-07 14:41 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2025-01-02 7:26 [PATCH v2] eal: fix unused memseg length Yang Ming
-- strict thread matches above, loose matches on Subject: below --
2024-12-26 8:10 [PATCH] Fix unused memseg length for memory issue Yang Ming
2025-01-02 8:58 ` [PATCH v2] eal: fix unused memseg length Yang Ming
2025-01-22 3:14 ` Yang Ming
2025-02-07 14:41 ` David Marchand
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).