[dpdk-dev] crash in virtio pmd

[dpdk-dev] crash in virtio pmd

[Olivier Matz]

Hi,

On 16.07-rc3, when I start testpmd with a virtio driver in a VM,
requesting options that are not implemented (rx checksum), it crashes:

./build/app/testpmd -l 0,1 --log-level 8 -- --total-num-mbufs=16384 -i
--port-topology=chained --disable-hw-vlan-filter --disable-hw-vlan-strip
--enable-rx-cksum --crc-strip --txqflags=0
EAL: Detected 3 lcore(s)
EAL: Probing VFIO support...
EAL: WARNING: cpu flags constant_tsc=yes nonstop_tsc=no -> using
unreliable clock cycles !
PMD: bnxt_rte_pmd_init() called for (null)
EAL: PCI device 0000:00:02.0 on NUMA socket -1
EAL:   probe driver: 8086:10fb rte_ixgbe_pmd
EAL: PCI device 0000:00:04.0 on NUMA socket -1
EAL:   probe driver: 8086:10fb rte_ixgbe_pmd
EAL: PCI device 0000:00:05.0 on NUMA socket -1
EAL:   probe driver: 1af4:1000 rte_virtio_pmd
PMD: virtio_read_caps(): no modern virtio pci device found.
PMD: vtpci_init(): trying with legacy virtio pci.
Interactive-mode selected
USER1: create a new mbuf pool <mbuf_pool_socket_0>: n=16384, size=2176,
socket=0
Configuring Port 0 (socket 0)
Port 0: 00:1B:21:AB:8F:10
Configuring Port 1 (socket 0)
Segmentation fault


The crash occurs here (rxvq is NULL):

  void
  virtio_dev_rx_queue_release(void *rxq)
  {
          struct virtnet_rx *rxvq = rxq;
  =>      struct virtqueue *vq = rxvq->vq;
          /* rxvq is freed when vq is freed, and as mz should be freed
after the
           * del_queue, so we reserve the mz pointer first.

           */
          const struct rte_memzone *mz = rxvq->mz;


Here is the backtrace:

#0  0x0000000000b01744 in virtio_dev_rx_queue_release (rxq=0x0) at
/root/dpdk.org/drivers/net/virtio/virtio_rxtx.\
c:470
#1  0x0000000000583783 in rte_eth_dev_rx_queue_config (dev=0x10ac700
<rte_eth_devices+16512>, nb_queues=0) at /ro\
ot/dpdk.org/lib/librte_ether/rte_ethdev.c:713
#2  0x00000000005840e1 in rte_eth_dev_configure (port_id=1 '\001',
nb_rx_q=1, nb_tx_q=1, dev_conf=0x7fffd41a3838)\
 at /root/dpdk.org/lib/librte_ether/rte_ethdev.c:1027
#3  0x0000000000440037 in start_port (pid=255 '\377') at
/root/dpdk.org/app/test-pmd/testpmd.c:1338
#4  0x00000000004419d9 in main (argc=9, argv=0x7fffffffe630) at
/root/dpdk.org/app/test-pmd/testpmd.c:2114


Actually, virtio_dev_configure() returns an error here:

        if (rxmode->hw_ip_checksum) {
                PMD_DRV_LOG(ERR, "HW IP checksum not supported");
=>              return -EINVAL;
        }


Then, rte_eth_dev_configure() tries to do some cleanup and crashes here:

          diag = (*dev->dev_ops->dev_configure)(dev);
          if (diag != 0) {
                  RTE_PMD_DEBUG_TRACE("port%d dev_configure = %d\n",
                                  port_id, diag);
  =>              rte_eth_dev_rx_queue_config(dev, 0);
                  rte_eth_dev_tx_queue_config(dev, 0);
                  return diag;
          }


I suppose it is related to this commit:
http://dpdk.org/browse/dpdk/commit/?id=01ad44fd374fb8ecb9ecc80b9bfd1f45dbaa4a1f


Sorry, I have not a lot of time to investigate further, hope you can
find the appropriate fix with the info above.


Regards,
Olivier

Re: [dpdk-dev] crash in virtio pmd

[Olivier Matz]

Sorry, there was a typo in Huawei's mail, I copy-pasted it from the
other thread "[dpdk-dev] virtio PMD issue".


On 07/18/2016 06:06 PM, Olivier Matz wrote:
> Hi,
> 
> On 16.07-rc3, when I start testpmd with a virtio driver in a VM,
> requesting options that are not implemented (rx checksum), it crashes:
> 
> ./build/app/testpmd -l 0,1 --log-level 8 -- --total-num-mbufs=16384 -i
> --port-topology=chained --disable-hw-vlan-filter --disable-hw-vlan-strip
> --enable-rx-cksum --crc-strip --txqflags=0
> EAL: Detected 3 lcore(s)
> EAL: Probing VFIO support...
> EAL: WARNING: cpu flags constant_tsc=yes nonstop_tsc=no -> using
> unreliable clock cycles !
> PMD: bnxt_rte_pmd_init() called for (null)
> EAL: PCI device 0000:00:02.0 on NUMA socket -1
> EAL:   probe driver: 8086:10fb rte_ixgbe_pmd
> EAL: PCI device 0000:00:04.0 on NUMA socket -1
> EAL:   probe driver: 8086:10fb rte_ixgbe_pmd
> EAL: PCI device 0000:00:05.0 on NUMA socket -1
> EAL:   probe driver: 1af4:1000 rte_virtio_pmd
> PMD: virtio_read_caps(): no modern virtio pci device found.
> PMD: vtpci_init(): trying with legacy virtio pci.
> Interactive-mode selected
> USER1: create a new mbuf pool <mbuf_pool_socket_0>: n=16384, size=2176,
> socket=0
> Configuring Port 0 (socket 0)
> Port 0: 00:1B:21:AB:8F:10
> Configuring Port 1 (socket 0)
> Segmentation fault
> 
> 
> The crash occurs here (rxvq is NULL):
> 
>   void
>   virtio_dev_rx_queue_release(void *rxq)
>   {
>           struct virtnet_rx *rxvq = rxq;
>   =>      struct virtqueue *vq = rxvq->vq;
>           /* rxvq is freed when vq is freed, and as mz should be freed
> after the
>            * del_queue, so we reserve the mz pointer first.
> 
>            */
>           const struct rte_memzone *mz = rxvq->mz;
> 
> 
> Here is the backtrace:
> 
> #0  0x0000000000b01744 in virtio_dev_rx_queue_release (rxq=0x0) at
> /root/dpdk.org/drivers/net/virtio/virtio_rxtx.\
> c:470
> #1  0x0000000000583783 in rte_eth_dev_rx_queue_config (dev=0x10ac700
> <rte_eth_devices+16512>, nb_queues=0) at /ro\
> ot/dpdk.org/lib/librte_ether/rte_ethdev.c:713
> #2  0x00000000005840e1 in rte_eth_dev_configure (port_id=1 '\001',
> nb_rx_q=1, nb_tx_q=1, dev_conf=0x7fffd41a3838)\
>  at /root/dpdk.org/lib/librte_ether/rte_ethdev.c:1027
> #3  0x0000000000440037 in start_port (pid=255 '\377') at
> /root/dpdk.org/app/test-pmd/testpmd.c:1338
> #4  0x00000000004419d9 in main (argc=9, argv=0x7fffffffe630) at
> /root/dpdk.org/app/test-pmd/testpmd.c:2114
> 
> 
> Actually, virtio_dev_configure() returns an error here:
> 
>         if (rxmode->hw_ip_checksum) {
>                 PMD_DRV_LOG(ERR, "HW IP checksum not supported");
> =>              return -EINVAL;
>         }
> 
> 
> Then, rte_eth_dev_configure() tries to do some cleanup and crashes here:
> 
>           diag = (*dev->dev_ops->dev_configure)(dev);
>           if (diag != 0) {
>                   RTE_PMD_DEBUG_TRACE("port%d dev_configure = %d\n",
>                                   port_id, diag);
>   =>              rte_eth_dev_rx_queue_config(dev, 0);
>                   rte_eth_dev_tx_queue_config(dev, 0);
>                   return diag;
>           }
> 
> 
> I suppose it is related to this commit:
> http://dpdk.org/browse/dpdk/commit/?id=01ad44fd374fb8ecb9ecc80b9bfd1f45dbaa4a1f
> 
> 
> Sorry, I have not a lot of time to investigate further, hope you can
> find the appropriate fix with the info above.
> 
> 
> Regards,
> Olivier
> 

Re: [dpdk-dev] crash in virtio pmd

[Yuanhan Liu]

On Mon, Jul 18, 2016 at 06:06:53PM +0200, Olivier Matz wrote:
> Hi,
> 
> On 16.07-rc3, when I start testpmd with a virtio driver in a VM,
> requesting options that are not implemented (rx checksum), it crashes:
> 
...

> Sorry, I have not a lot of time to investigate further, hope you can
> find the appropriate fix with the info above.

Nope, thanks for the report and detailed info. I think a simple NULL
check is enough here. Will send the fix soon.

	--yliu

[dpdk-dev] [PATCH] net/virtio: fix crash on null dereference

[Yuanhan Liu]

The rxq/txq for the queue_release callback could be NULL, say when
rte_eth_dev_configure() fails that the queue is not setup at all.

Do a simple NULL check would fix the crash issue.

Fixes: 01ad44fd374f ("net/virtio: split Rx/Tx queue")

Reported-by: Olivier Matz <olivier.matz@6wind.com>
Signed-off-by: Yuanhan Liu <yuanhan.liu@linux.intel.com>
---
 drivers/net/virtio/virtio_rxtx.c | 30 ++++++++++++++++++++++--------
 1 file changed, 22 insertions(+), 8 deletions(-)

diff --git a/drivers/net/virtio/virtio_rxtx.c b/drivers/net/virtio/virtio_rxtx.c
index a27208e..2f967de 100644
--- a/drivers/net/virtio/virtio_rxtx.c
+++ b/drivers/net/virtio/virtio_rxtx.c
@@ -467,13 +467,19 @@ void
 virtio_dev_rx_queue_release(void *rxq)
 {
 	struct virtnet_rx *rxvq = rxq;
-	struct virtqueue *vq = rxvq->vq;
-	/* rxvq is freed when vq is freed, and as mz should be freed after the
+	struct virtqueue *vq;
+	const struct rte_memzone *mz;
+
+	if (rxvq == NULL)
+		return;
+
+	/*
+	 * rxvq is freed when vq is freed, and as mz should be freed after the
 	 * del_queue, so we reserve the mz pointer first.
 	 */
-	const struct rte_memzone *mz = rxvq->mz;
+	vq = rxvq->vq;
+	mz = rxvq->mz;
 
-	/* no need to free rxq as vq and rxq are allocated together */
 	virtio_dev_queue_release(vq);
 	rte_memzone_free(mz);
 }
@@ -553,12 +559,20 @@ void
 virtio_dev_tx_queue_release(void *txq)
 {
 	struct virtnet_tx *txvq = txq;
-	struct virtqueue *vq = txvq->vq;
-	/* txvq is freed when vq is freed, and as mz should be freed after the
+	struct virtqueue *vq;
+	const struct rte_memzone *mz;
+	const struct rte_memzone *hdr_mz;
+
+	if (txvq == NULL)
+		return;
+
+	/*
+	 * txvq is freed when vq is freed, and as mz should be freed after the
 	 * del_queue, so we reserve the mz pointer first.
 	 */
-	const struct rte_memzone *hdr_mz = txvq->virtio_net_hdr_mz;
-	const struct rte_memzone *mz = txvq->mz;
+	vq = txvq->vq;
+	mz = txvq->mz;
+	hdr_mz = txvq->virtio_net_hdr_mz;
 
 	virtio_dev_queue_release(vq);
 	rte_memzone_free(mz);
-- 
1.9.0

Re: [dpdk-dev] [PATCH] net/virtio: fix crash on null dereference

[Thomas Monjalon]

2016-07-19 10:39, Yuanhan Liu:
> The rxq/txq for the queue_release callback could be NULL, say when
> rte_eth_dev_configure() fails that the queue is not setup at all.
> 
> Do a simple NULL check would fix the crash issue.
> 
> Fixes: 01ad44fd374f ("net/virtio: split Rx/Tx queue")
> 
> Reported-by: Olivier Matz <olivier.matz@6wind.com>
> Signed-off-by: Yuanhan Liu <yuanhan.liu@linux.intel.com>

Applied, thanks