From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from dpdk.org (dpdk.org [92.243.14.124]) by inbox.dpdk.org (Postfix) with ESMTP id B1FB6A0597; Thu, 9 Apr 2020 15:03:59 +0200 (CEST) Received: from [92.243.14.124] (localhost [127.0.0.1]) by dpdk.org (Postfix) with ESMTP id 99BBC1C23C; Thu, 9 Apr 2020 15:03:59 +0200 (CEST) Received: from mga05.intel.com (mga05.intel.com [192.55.52.43]) by dpdk.org (Postfix) with ESMTP id 2A9091C204; Thu, 9 Apr 2020 15:03:57 +0200 (CEST) IronPort-SDR: 06zydmrhugzorEJlbZjOHO3LQBRvIpDEU+UEXseM22AwsYDzfUgXsK64Hgqrkl++MNVWmr3jpT gGD7GRhvcQgw== X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga003.fm.intel.com ([10.253.24.29]) by fmsmga105.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 09 Apr 2020 06:03:56 -0700 IronPort-SDR: 6sx12Xp3LHuFbRSqwgqAfJptjsPdxjm1/BjT3LUXj2N47ns8EQT7LmItqem6p2D+HgQnNHU+6B ECyuSnvNBhUg== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.72,362,1580803200"; d="scan'208";a="297519492" Received: from fyigit-mobl.ger.corp.intel.com (HELO [10.252.7.25]) ([10.252.7.25]) by FMSMGA003.fm.intel.com with ESMTP; 09 Apr 2020 06:03:54 -0700 To: wangyunjian , "dev@dpdk.org" Cc: "keith.wiles@intel.com" , "Lilijun (Jerry)" , xudingke , "stable@dpdk.org" References: <1586233357-2580-1-git-send-email-wangyunjian@huawei.com> <34EFBCA9F01B0748BEB6B629CE643AE60CF5FDB2@DGGEMM533-MBX.china.huawei.com> <34EFBCA9F01B0748BEB6B629CE643AE60CF60039@DGGEMM533-MBX.china.huawei.com> From: Ferruh Yigit Autocrypt: addr=ferruh.yigit@intel.com; prefer-encrypt=mutual; keydata= mQINBFXZCFABEADCujshBOAaqPZpwShdkzkyGpJ15lmxiSr3jVMqOtQS/sB3FYLT0/d3+bvy qbL9YnlbPyRvZfnP3pXiKwkRoR1RJwEo2BOf6hxdzTmLRtGtwWzI9MwrUPj6n/ldiD58VAGQ +iR1I/z9UBUN/ZMksElA2D7Jgg7vZ78iKwNnd+vLBD6I61kVrZ45Vjo3r+pPOByUBXOUlxp9 GWEKKIrJ4eogqkVNSixN16VYK7xR+5OUkBYUO+sE6etSxCr7BahMPKxH+XPlZZjKrxciaWQb +dElz3Ab4Opl+ZT/bK2huX+W+NJBEBVzjTkhjSTjcyRdxvS1gwWRuXqAml/sh+KQjPV1PPHF YK5LcqLkle+OKTCa82OvUb7cr+ALxATIZXQkgmn+zFT8UzSS3aiBBohg3BtbTIWy51jNlYdy ezUZ4UxKSsFuUTPt+JjHQBvF7WKbmNGS3fCid5Iag4tWOfZoqiCNzxApkVugltxoc6rG2TyX CmI2rP0mQ0GOsGXA3+3c1MCdQFzdIn/5tLBZyKy4F54UFo35eOX8/g7OaE+xrgY/4bZjpxC1 1pd66AAtKb3aNXpHvIfkVV6NYloo52H+FUE5ZDPNCGD0/btFGPWmWRmkPybzColTy7fmPaGz cBcEEqHK4T0aY4UJmE7Ylvg255Kz7s6wGZe6IR3N0cKNv++O7QARAQABtCVGZXJydWggWWln aXQgPGZlcnJ1aC55aWdpdEBpbnRlbC5jb20+iQJUBBMBCgA+AhsDAh4BAheABQsJCAcDBRUK CQgLBRYCAwEAFiEE0jZTh0IuwoTjmYHH+TPrQ98TYR8FAl1meboFCQlupOoACgkQ+TPrQ98T YR9ACBAAv2tomhyxY0Tp9Up7mNGLfEdBu/7joB/vIdqMRv63ojkwr9orQq5V16V/25+JEAD0 60cKodBDM6HdUvqLHatS8fooWRueSXHKYwJ3vxyB2tWDyZrLzLI1jxEvunGodoIzUOtum0Ce gPynnfQCelXBja0BwLXJMplM6TY1wXX22ap0ZViC0m714U5U4LQpzjabtFtjT8qOUR6L7hfy YQ72PBuktGb00UR/N5UrR6GqB0x4W41aZBHXfUQnvWIMmmCrRUJX36hOTYBzh+x86ULgg7H2 1499tA4o6rvE13FiGccplBNWCAIroAe/G11rdoN5NBgYVXu++38gTa/MBmIt6zRi6ch15oLA Ln2vHOdqhrgDuxjhMpG2bpNE36DG/V9WWyWdIRlz3NYPCDM/S3anbHlhjStXHOz1uHOnerXM 1jEjcsvmj1vSyYoQMyRcRJmBZLrekvgZeh7nJzbPHxtth8M7AoqiZ/o/BpYU+0xZ+J5/szWZ aYxxmIRu5ejFf+Wn9s5eXNHmyqxBidpCWvcbKYDBnkw2+Y9E5YTpL0mS0dCCOlrO7gca27ux ybtbj84aaW1g0CfIlUnOtHgMCmz6zPXThb+A8H8j3O6qmPoVqT3qnq3Uhy6GOoH8Fdu2Vchh TWiF5yo+pvUagQP6LpslffufSnu+RKAagkj7/RSuZV25Ag0EV9ZMvgEQAKc0Db17xNqtSwEv mfp4tkddwW9XA0tWWKtY4KUdd/jijYqc3fDD54ESYpV8QWj0xK4YM0dLxnDU2IYxjEshSB1T qAatVWz9WtBYvzalsyTqMKP3w34FciuL7orXP4AibPtrHuIXWQOBECcVZTTOdZYGAzaYzxiA ONzF9eTiwIqe9/oaOjTwTLnOarHt16QApTYQSnxDUQljeNvKYt1lZE/gAUUxNLWsYyTT+22/ vU0GDUahsJxs1+f1yEr+OGrFiEAmqrzpF0lCS3f/3HVTU6rS9cK3glVUeaTF4+1SK5ZNO35p iVQCwphmxa+dwTG/DvvHYCtgOZorTJ+OHfvCnSVjsM4kcXGjJPy3JZmUtyL9UxEbYlrffGPQ I3gLXIGD5AN5XdAXFCjjaID/KR1c9RHd7Oaw0Pdcq9UtMLgM1vdX8RlDuMGPrj5sQrRVbgYH fVU/TQCk1C9KhzOwg4Ap2T3tE1umY/DqrXQgsgH71PXFucVjOyHMYXXugLT8YQ0gcBPHy9mZ qw5mgOI5lCl6d4uCcUT0l/OEtPG/rA1lxz8ctdFBVOQOxCvwRG2QCgcJ/UTn5vlivul+cThi 6ERPvjqjblLncQtRg8izj2qgmwQkvfj+h7Ex88bI8iWtu5+I3K3LmNz/UxHBSWEmUnkg4fJl Rr7oItHsZ0ia6wWQ8lQnABEBAAGJAjwEGAEKACYCGwwWIQTSNlOHQi7ChOOZgcf5M+tD3xNh HwUCXWZ5wAUJB3FgggAKCRD5M+tD3xNhH2O+D/9OEz62YuJQLuIuOfL67eFTIB5/1+0j8Tsu o2psca1PUQ61SZJZOMl6VwNxpdvEaolVdrpnSxUF31kPEvR0Igy8HysQ11pj8AcgH0a9FrvU /8k2Roccd2ZIdpNLkirGFZR7LtRw41Kt1Jg+lafI0efkiHKMT/6D/P1EUp1RxOBNtWGV2hrd 0Yg9ds+VMphHHU69fDH02SwgpvXwG8Qm14Zi5WQ66R4CtTkHuYtA63sS17vMl8fDuTCtvfPF HzvdJLIhDYN3Mm1oMjKLlq4PUdYh68Fiwm+boJoBUFGuregJFlO3hM7uHBDhSEnXQr5mqpPM 6R/7Q5BjAxrwVBisH0yQGjsWlnysRWNfExAE2sRePSl0or9q19ddkRYltl6X4FDUXy2DTXa9 a+Fw4e1EvmcF3PjmTYs9IE3Vc64CRQXkhujcN4ZZh5lvOpU8WgyDxFq7bavFnSS6kx7Tk29/ wNJBp+cf9qsQxLbqhW5kfORuZGecus0TLcmpZEFKKjTJBK9gELRBB/zoN3j41hlEl7uTUXTI JQFLhpsFlEdKLujyvT/aCwP3XWT+B2uZDKrMAElF6ltpTxI53JYi22WO7NH7MR16Fhi4R6vh FHNBOkiAhUpoXRZXaCR6+X4qwA8CwHGqHRBfYFSU/Ulq1ZLR+S3hNj2mbnSx0lBs1eEqe2vh cA== Message-ID: <9fcd1c5c-bd50-66cc-f794-77264ea701af@intel.com> Date: Thu, 9 Apr 2020 14:03:53 +0100 MIME-Version: 1.0 In-Reply-To: <34EFBCA9F01B0748BEB6B629CE643AE60CF60039@DGGEMM533-MBX.china.huawei.com> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit Subject: Re: [dpdk-dev] [dpdk-stable] [PATCH v3 1/5] net/tap: fix mbuf double free when writev fails X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" On 4/9/2020 1:53 PM, wangyunjian wrote: > > >> -----Original Message----- >> From: Ferruh Yigit [mailto:ferruh.yigit@intel.com] >> Sent: Thursday, April 9, 2020 5:52 PM >> To: wangyunjian ; dev@dpdk.org >> Cc: keith.wiles@intel.com; Lilijun (Jerry) ; xudingke >> ; stable@dpdk.org >> Subject: Re: [dpdk-stable] [dpdk-dev] [PATCH v3 1/5] net/tap: fix mbuf double >> free when writev fails >> >> On 4/9/2020 9:03 AM, wangyunjian wrote: >>> >>> >>>> -----Original Message----- >>>> From: Ferruh Yigit [mailto:ferruh.yigit@intel.com] >>>> Sent: Tuesday, April 7, 2020 8:35 PM >>>> To: wangyunjian ; dev@dpdk.org >>>> Cc: keith.wiles@intel.com; Lilijun (Jerry) >>>> ; xudingke ; >>>> stable@dpdk.org >>>> Subject: Re: [dpdk-stable] [dpdk-dev] [PATCH v3 1/5] net/tap: fix >>>> mbuf double free when writev fails >>>> >>>> On 4/7/2020 5:22 AM, wangyunjian wrote: >>>>> From: Yunjian Wang >>>>> >>>>> When the tap_write_mbufs() function return with break, mbuf was >>>>> freed without incrementing num_packets. This may lead applications >>>>> also free the mbuf. And the pmd_tx_burst() function should returns >>>>> the number of original packets it actually sent excluding tso mbufs. >>>>> >>>>> Fixes: 9396ad334672 ("net/tap: fix reported number of Tx packets") >>>>> CC: stable@dpdk.org >>>>> >>>>> Signed-off-by: Yunjian Wang >>>>> --- >>>>> drivers/net/tap/rte_eth_tap.c | 21 +++++++++++++++------ >>>>> 1 file changed, 15 insertions(+), 6 deletions(-) >>>>> >>>>> diff --git a/drivers/net/tap/rte_eth_tap.c >>>>> b/drivers/net/tap/rte_eth_tap.c index 05470a211..4c4b6b0b2 100644 >>>>> --- a/drivers/net/tap/rte_eth_tap.c >>>>> +++ b/drivers/net/tap/rte_eth_tap.c >>>>> @@ -521,7 +521,7 @@ tap_tx_l3_cksum(char *packet, uint64_t ol_flags, >>>> unsigned int l2_len, >>>>> } >>>>> } >>>>> >>>>> -static inline void >>>>> +static inline int >>>>> tap_write_mbufs(struct tx_queue *txq, uint16_t num_mbufs, >>>>> struct rte_mbuf **pmbufs, >>>>> uint16_t *num_packets, unsigned long *num_tx_bytes) >> @@ >>>> -588,7 >>>>> +588,7 @@ tap_write_mbufs(struct tx_queue *txq, uint16_t num_mbufs, >>>>> seg_len = rte_pktmbuf_data_len(mbuf); >>>>> l234_hlen = mbuf->l2_len + mbuf->l3_len + mbuf->l4_len; >>>>> if (seg_len < l234_hlen) >>>>> - break; >>>>> + return -1; >>>>> >>>>> /* To change checksums, work on a * copy of l2, l3 >>>>> * headers + l4 pseudo header >>>>> @@ -634,10 +634,12 @@ tap_write_mbufs(struct tx_queue *txq, >> uint16_t >>>> num_mbufs, >>>>> /* copy the tx frame data */ >>>>> n = writev(process_private->txq_fds[txq->queue_id], iovecs, j); >>>>> if (n <= 0) >>>>> - break; >>>>> + return -1; >>>>> + >>>>> (*num_packets)++; >>>>> (*num_tx_bytes) += rte_pktmbuf_pkt_len(mbuf); >>>>> } >>>>> + return 0; >>>>> } >>>>> >>>>> /* Callback to handle sending packets from the tap interface @@ >>>>> -708,8 +710,15 @@ pmd_tx_burst(void *queue, struct rte_mbuf **bufs, >>>> uint16_t nb_pkts) >>>>> num_mbufs = 1; >>>>> } >>>>> >>>>> - tap_write_mbufs(txq, num_mbufs, mbuf, >>>>> - &num_packets, &num_tx_bytes); >>>>> + ret = tap_write_mbufs(txq, num_mbufs, mbuf, >>>>> + &num_packets, &num_tx_bytes); >>>> >>>> reusing 'ret' here breaks the logic at the end of the loop that free >>>> tso mbufs, which expects 'ret' is number of mbufs in tso case. >>>> >>>>> + if (ret != 0) { >>>>> + txq->stats.errs++; >>>>> + /* free tso mbufs */ >>>>> + for (j = 0; j < ret; j++) >>>> >>>> 'ret' only can be '0' or '-1', and we take the branch only when it is >>>> '-1', so this block is not used at all and it doesn't free any mbuf. >>> >>> I'm sorry for my mistakes. I will fix it in next version. >>> what about following: >>> >>> error = tap_write_mbufs(txq, num_mbufs, mbuf, >>> &num_packets, &num_tx_bytes); if (error == -1) { >>> txq->stats.errs++; >>> /* free tso mbufs */ >>> for (j = 0; j < ret; j++) >>> rte_pktmbuf_free(mbuf[j]); >>> break; >>> } >> >> +1, but still needs to free the 'mbuf_in' before break. > > I don't think it needs to free the 'mbuf_in' before break. > The 'num_tx' does not increase, the caller will free unsent packets. Yep, you are right. > >> >> Or maybe it is better to create a new variable like 'num_tso_mbufs' and use it >> instead of 'ret', which is more readable, and this enables to reuse the 'ret'. > > Thanks for your suggestion, will include it in next version. > > Yunjian > >> >>> >>> Thanks >>> Yunjian >>>>> + rte_pktmbuf_free(mbuf[j]); >>>> >>>> >>>> In the no tso case, if the 'tap_write_mbufs()' fails, this doesn't >>>> free the 'mbuf_in'. >>>> >>>>> + break; >>>>> + } >>>>> num_tx++; >>>>> /* free original mbuf */ >>>>> rte_pktmbuf_free(mbuf_in); >>>>> @@ -722,7 +731,7 @@ pmd_tx_burst(void *queue, struct rte_mbuf >>>>> **bufs, >>>> uint16_t nb_pkts) >>>>> txq->stats.errs += nb_pkts - num_tx; >>>>> txq->stats.obytes += num_tx_bytes; >>>>> >>>>> - return num_packets; >>>>> + return num_tx; >>>> >>>> +1 to return number of original packets. >>>> >>>>> } >>>>> >>>>> static const char * >>>>> >>> >