From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from dpdk.org (dpdk.org [92.243.14.124]) by inbox.dpdk.org (Postfix) with ESMTP id 2E42CA0352; Thu, 9 Jan 2020 08:52:37 +0100 (CET) Received: from [92.243.14.124] (localhost [127.0.0.1]) by dpdk.org (Postfix) with ESMTP id 71FDD1DBC0; Thu, 9 Jan 2020 08:52:36 +0100 (CET) Received: from inbox.dpdk.org (xvm-172-178.dc0.ghst.net [95.142.172.178]) by dpdk.org (Postfix) with ESMTP id 45B281DBBC for ; Thu, 9 Jan 2020 08:52:35 +0100 (CET) Received: by inbox.dpdk.org (Postfix, from userid 33) id 21798A04F3; Thu, 9 Jan 2020 08:52:35 +0100 (CET) From: bugzilla@dpdk.org To: dev@dpdk.org Date: Thu, 09 Jan 2020 07:52:34 +0000 X-Bugzilla-Reason: AssignedTo X-Bugzilla-Type: new X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: DPDK X-Bugzilla-Component: ethdev X-Bugzilla-Version: 18.11 X-Bugzilla-Keywords: X-Bugzilla-Severity: normal X-Bugzilla-Who: zhongdahulinfan@163.com X-Bugzilla-Status: UNCONFIRMED X-Bugzilla-Resolution: X-Bugzilla-Priority: Normal X-Bugzilla-Assigned-To: dev@dpdk.org X-Bugzilla-Target-Milestone: --- X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: bug_id short_desc product version rep_platform op_sys bug_status bug_severity priority component assigned_to reporter target_milestone Message-ID: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: http://bugs.dpdk.org/ Auto-Submitted: auto-generated X-Auto-Response-Suppress: All MIME-Version: 1.0 Subject: [dpdk-dev] [Bug 382] rte_eth: rx/tx callbacks invoked without lock protection X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" https://bugs.dpdk.org/show_bug.cgi?id=3D382 Bug ID: 382 Summary: rte_eth: rx/tx callbacks invoked without lock protection Product: DPDK Version: 18.11 Hardware: All OS: All Status: UNCONFIRMED Severity: normal Priority: Normal Component: ethdev Assignee: dev@dpdk.org Reporter: zhongdahulinfan@163.com Target Milestone: --- Hi, all=20=20 I launch my DPDK app, and then use dpdk-pdump to capture wire packets. = When I stop dpdk-pdump with ctrl+c, my DPDK app crash. Here is the coredump backtrace:=20=20 ``` [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". Core was generated by `/usr/sbin/dpvs -- -l 0,1,2,3,4,5,6,7,8 -w 0000:04:00= .0 -w 0000:04:00.1 --legacy'. Program terminated with signal SIGSEGV, Segmentation fault. #0 0x00005555558d24e3 in rte_eth_rx_burst (port_id=3D1, queue_id=3D2, rx_pkts=3D0x55555721ed10 , nb_pkts=3D32) at /builds/lbc/kigw/kigw_scripts/dpdk-stable-18.11.2/build/include/rte_ethdev.= h:3888 3888=20=20=20 /builds/lbc/kigw/kigw_scripts/dpdk-stable-18.11.2/build/include/rte_ethdev.= h: No such file or directory. [Current thread is 1 (Thread 0x7ffff3d36700 (LWP 29228))] (gdb) bt #0 0x00005555558d24e3 in rte_eth_rx_burst (port_id=3D1, queue_id=3D2, rx_pkts=3D0x55555721ed10 , nb_pkts=3D32) at /builds/lbc/kigw/kigw_scripts/dpdk-stable-18.11.2/build/include/rte_ethdev.= h:3888 #1 0x00005555558d8743 in netif_rx_burst (pid=3D1, qconf=3D0x55555721ed00 ) at /builds/lbc/kigw/src/netif.c:1618 #2 0x00005555558dc331 in lcore_job_recv_fwd (arg=3D0x0) at /builds/lbc/kigw/src/netif.c:2424 #3 0x00005555558e16de in do_lcore_job (job=3D0x555555f6f980 ) = at /builds/lbc/kigw/src/netif.c:4265 #4 0x00005555558e184d in netif_loop (dummy=3D0x0) at /builds/lbc/kigw/src/netif.c:4307 #5 0x00005555556cfb9d in eal_thread_loop () #6 0x00007ffff67744a4 in start_thread (arg=3D0x7ffff3d36700) at pthread_create.c:456 #7 0x00007ffff62abd0f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:97 ``` I followed the source code in rte_ethdev.h where the segmentation fault occurred in line 3888:=20=20 ``` static inline uint16_t rte_eth_rx_burst(uint16_t port_id, uint16_t queue_id, struct rte_mbuf **rx_pkts, const uint16_t nb_pkts) { struct rte_eth_dev *dev =3D &rte_eth_devices[port_id]; uint16_t nb_rx; #ifdef RTE_LIBRTE_ETHDEV_DEBUG RTE_ETH_VALID_PORTID_OR_ERR_RET(port_id, 0); RTE_FUNC_PTR_OR_ERR_RET(*dev->rx_pkt_burst, 0); if (queue_id >=3D dev->data->nb_rx_queues) { RTE_ETHDEV_LOG(ERR, "Invalid RX queue_id=3D%u\n", queue_id); return 0; } #endif nb_rx =3D (*dev->rx_pkt_burst)(dev->data->rx_queues[queue_id], rx_pkts, nb_pkts); #ifdef RTE_ETHDEV_RXTX_CALLBACKS if (unlikely(dev->post_rx_burst_cbs[queue_id] !=3D NULL)) { struct rte_eth_rxtx_callback *cb =3D dev->post_rx_burst_cbs[queue_id]; do { nb_rx =3D cb->fn.rx(port_id, queue_id, rx_pkts, nb_= rx, nb_pkts, cb->param); cb =3D cb->next; } while (cb !=3D NULL); } #endif return nb_rx; } ``` Found that callback list doesn't protected by any lock. These may have concurrent issues when another process like dpdk-pdump unregister tx/rx callbacks before it exits. The registration/unregistration of tx/rx callbac= ks hold a spinlock. I wonder why there is no lock in invocation of callback li= st.=20=20 ``` int rte_eth_remove_rx_callback(uint16_t port_id, uint16_t queue_id, const struct rte_eth_rxtx_callback *user_cb) { #ifndef RTE_ETHDEV_RXTX_CALLBACKS return -ENOTSUP; #endif /* Check input parameters. */ RTE_ETH_VALID_PORTID_OR_ERR_RET(port_id, -EINVAL); if (user_cb =3D=3D NULL || queue_id >=3D rte_eth_devices[port_id].data->nb_rx_queues) return -EINVAL; struct rte_eth_dev *dev =3D &rte_eth_devices[port_id]; struct rte_eth_rxtx_callback *cb; struct rte_eth_rxtx_callback **prev_cb; int ret =3D -EINVAL; rte_spinlock_lock(&rte_eth_rx_cb_lock); prev_cb =3D &dev->post_rx_burst_cbs[queue_id]; for (; *prev_cb !=3D NULL; prev_cb =3D &cb->next) { cb =3D *prev_cb; if (cb =3D=3D user_cb) { /* Remove the user cb from the callback list. */ *prev_cb =3D cb->next; ret =3D 0; break; } } rte_spinlock_unlock(&rte_eth_rx_cb_lock); return ret; }=20 ``` Please check and conform if this is a bug. Thanks, Linfan Hu --=20 You are receiving this mail because: You are the assignee for the bug.=