[PATCH] net/mlx5: fix Rx queue control deref

[PATCH] net/mlx5: fix Rx queue control deref

[Bing Zhao]

When the Rx queue is shared, only the control structure is shared and
the private structure of each Rx queue is still independent. During
the port stop stage, the hardware resource will be released, and the
memory will be freed in the device close stage. Then the control
structure reference count should be decreased when freeing a private
structure.

In the previous implementation, the decreasing action was wrongly
put inside the owners list empty condition. Indeed, they should be
in the same level. And since the reference count was set to 1 after
the 1st queue is created, when checking the value, it should be
subtracted firstly and then check the value.

With this commit, the reference calculation and condition checking
will be corrected. The shared Rx queues' control structures will be
freed successlly to avoid the crash in the port restarting.

Fixes: 3c9a82fa6edc ("net/mlx5: fix Rx queue control management")
Cc: stable@dpdk.org

Signed-off-by: Bing Zhao <bingz@nvidia.com>
Acked-by: Dariusz Sosnowski <dsosnowski@nvidia.com>
---
 drivers/net/mlx5/mlx5_rx.h  |  2 +-
 drivers/net/mlx5/mlx5_rxq.c | 12 ++++++------
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/drivers/net/mlx5/mlx5_rx.h b/drivers/net/mlx5/mlx5_rx.h
index da7c448948..1a6f174c40 100644
--- a/drivers/net/mlx5/mlx5_rx.h
+++ b/drivers/net/mlx5/mlx5_rx.h
@@ -157,7 +157,7 @@ struct mlx5_rxq_ctrl {
 	bool is_hairpin; /* Whether RxQ type is Hairpin. */
 	unsigned int socket; /* CPU socket ID for allocations. */
 	LIST_ENTRY(mlx5_rxq_ctrl) share_entry; /* Entry in shared RXQ list. */
-	RTE_ATOMIC(uint32_t) ctrl_ref; /* Reference counter. */
+	RTE_ATOMIC(int32_t) ctrl_ref; /* Reference counter. */
 	uint32_t share_group; /* Group ID of shared RXQ. */
 	uint16_t share_qid; /* Shared RxQ ID in group. */
 	unsigned int started:1; /* Whether (shared) RXQ has been started. */
diff --git a/drivers/net/mlx5/mlx5_rxq.c b/drivers/net/mlx5/mlx5_rxq.c
index 0737f60272..126b1970e6 100644
--- a/drivers/net/mlx5/mlx5_rxq.c
+++ b/drivers/net/mlx5/mlx5_rxq.c
@@ -2268,6 +2268,7 @@ mlx5_rxq_release(struct rte_eth_dev *dev, uint16_t idx)
 	struct mlx5_rxq_priv *rxq;
 	struct mlx5_rxq_ctrl *rxq_ctrl;
 	uint32_t refcnt;
+	int32_t ctrl_ref;
 
 	if (priv->rxq_privs == NULL)
 		return 0;
@@ -2293,15 +2294,14 @@ mlx5_rxq_release(struct rte_eth_dev *dev, uint16_t idx)
 		}
 	} else { /* Refcnt zero, closing device. */
 		LIST_REMOVE(rxq, owner_entry);
-		if (LIST_EMPTY(&rxq_ctrl->owners)) {
+		ctrl_ref = rte_atomic_fetch_sub_explicit(&rxq_ctrl->ctrl_ref, 1,
+							 rte_memory_order_relaxed) - 1;
+		if (ctrl_ref == 1 && LIST_EMPTY(&rxq_ctrl->owners)) {
 			if (!rxq_ctrl->is_hairpin)
 				mlx5_mr_btree_free
 					(&rxq_ctrl->rxq.mr_ctrl.cache_bh);
-			if (rte_atomic_fetch_sub_explicit(&rxq_ctrl->ctrl_ref, 1,
-			    rte_memory_order_relaxed) == 1) {
-				LIST_REMOVE(rxq_ctrl, share_entry);
-				mlx5_free(rxq_ctrl);
-			}
+			LIST_REMOVE(rxq_ctrl, share_entry);
+			mlx5_free(rxq_ctrl);
 		}
 		dev->data->rx_queues[idx] = NULL;
 		mlx5_free(rxq);
-- 
2.34.1

Re: [PATCH] net/mlx5: fix Rx queue control deref

[Raslan Darawsheh]

Hi,

From: Bing Zhao <bingz@nvidia.com>
Sent: Monday, November 25, 2024 7:23 PM
To: Dariusz Sosnowski; Slava Ovsiienko; dev@dpdk.org; Raslan Darawsheh
Cc: Ori Kam; Suanming Mou; Matan Azrad; stable@dpdk.org
Subject: [PATCH] net/mlx5: fix Rx queue control deref

When the Rx queue is shared, only the control structure is shared and
the private structure of each Rx queue is still independent. During
the port stop stage, the hardware resource will be released, and the
memory will be freed in the device close stage. Then the control
structure reference count should be decreased when freeing a private
structure.

In the previous implementation, the decreasing action was wrongly
put inside the owners list empty condition. Indeed, they should be
in the same level. And since the reference count was set to 1 after
the 1st queue is created, when checking the value, it should be
subtracted firstly and then check the value.

With this commit, the reference calculation and condition checking
will be corrected. The shared Rx queues' control structures will be
freed successlly to avoid the crash in the port restarting.

Fixes: 3c9a82fa6edc ("net/mlx5: fix Rx queue control management")
Cc: stable@dpdk.org

Signed-off-by: Bing Zhao <bingz@nvidia.com>
Acked-by: Dariusz Sosnowski <dsosnowski@nvidia.com>

Patch applied to next-net-mlx,

Kindest regards,
Raslan Darawsheh