From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id BE6DBA034F; Fri, 12 Nov 2021 17:20:11 +0100 (CET) Received: from [217.70.189.124] (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id AEEE641145; Fri, 12 Nov 2021 17:20:11 +0100 (CET) Received: from inbox.dpdk.org (inbox.dpdk.org [95.142.172.178]) by mails.dpdk.org (Postfix) with ESMTP id 4BEE740692 for ; Fri, 12 Nov 2021 17:20:10 +0100 (CET) Received: by inbox.dpdk.org (Postfix, from userid 33) id 33AA8A0548; Fri, 12 Nov 2021 17:20:10 +0100 (CET) From: bugzilla@dpdk.org To: dev@dpdk.org Subject: [Bug 882] ixgbe dirver may resue some unreleased mbufs Date: Fri, 12 Nov 2021 16:20:09 +0000 X-Bugzilla-Reason: AssignedTo X-Bugzilla-Type: new X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: DPDK X-Bugzilla-Component: ethdev X-Bugzilla-Version: 20.11 X-Bugzilla-Keywords: X-Bugzilla-Severity: normal X-Bugzilla-Who: zhengbin.89740@bytedance.com X-Bugzilla-Status: UNCONFIRMED X-Bugzilla-Resolution: X-Bugzilla-Priority: Normal X-Bugzilla-Assigned-To: dev@dpdk.org X-Bugzilla-Target-Milestone: --- X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: bug_id short_desc product version rep_platform op_sys bug_status bug_severity priority component assigned_to reporter target_milestone attachments.created Message-ID: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: http://bugs.dpdk.org/ Auto-Submitted: auto-generated X-Auto-Response-Suppress: All MIME-Version: 1.0 X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org https://bugs.dpdk.org/show_bug.cgi?id=3D882 Bug ID: 882 Summary: ixgbe dirver may resue some unreleased mbufs Product: DPDK Version: 20.11 Hardware: x86 OS: Linux Status: UNCONFIRMED Severity: normal Priority: Normal Component: ethdev Assignee: dev@dpdk.org Reporter: zhengbin.89740@bytedance.com Target Milestone: --- Created attachment 174 --> https://bugs.dpdk.org/attachment.cgi?id=3D174&action=3Dedit this demo can reproduce this bug file: drivers/net/ixgbe/ixgbe_rxtx_vec_sse.c:334 func: _recv_raw_pkts_vec() This bug will appear when the following conditions are met: 1. arg `nb_pkts` is greater than the `RTE_IXGBE_RXQ_REARM_THRESH` 2. the application holds mbuf instead of releasing it immediately On `_recv_raw_pkts_vec()`, if `nb_pkts` is greater than the `RTE_IXGBE_RXQ_REARM_THRESH` and `rx_tail` wrap back to zero,=20 in this case `rx_tail` may advance faster than `rxrearm_start`, which may c= ause some unreleased mbufs be reused.=20 e.g. nb_rx_desc: 1024 RDH: 972 RDT: 991 rxrearm_nb: 991 rxrearm_start: 992 rx_ta= il: 959 nb_rx_desc: 1024 RDH: 1004 RDT: 1023 rxrearm_nb: 991 rxrearm_start: 0 rx_ta= il: 991 nb_rx_desc: 1024 RDH: 12 RDT: 31 rxrearm_nb: 991 rxrearm_start: 32 rx_tail: 1023 nb_rx_desc: 1024 RDH: 31 RDT: 63 rxrearm_nb: 960 rxrearm_start: 64 rx_tail:= 0 nb_rx_desc: 1024 RDH: 95 RDT: 95 rxrearm_nb: 1016 rxrearm_start: 96 rx_tail= : 88 nb_rx_desc: 1024 RDH: 95 RDT: 127 rxrearm_nb: 991 rxrearm_start: 128 rx_tai= l: 95 ... nb_rx_desc: 1024 RDH: 908 RDT: 927 rxrearm_nb: 991 rxrearm_start: 928 rx_ta= il: 895 nb_rx_desc: 1024 RDH: 940 RDT: 959 rxrearm_nb: 991 rxrearm_start: 960 rx_ta= il: 927 nb_rx_desc: 1024 RDH: 980 RDT: 991 rxrearm_nb: 991 rxrearm_start: 992 rx_ta= il: 959 nb_rx_desc: 1024 RDH: 991 RDT: 991 rxrearm_nb: 1026 rxrearm_start: 992 rx_t= ail: 994 when `rx_tail` catches up with `rxrearm_start`, 2(994 - 992) unreleased mbu= f be reused! The simplest solution is to limit the size of `nb_pkts` to no more than `RTE_IXGBE_RXQ_REARM_THRESH`.=20 However, this method may affect the packet receiving speed of the applicati= on. Just like it. diff --git a/drivers/net/ixgbe/ixgbe_rxtx_vec_sse.c b/drivers/net/ixgbe/ixgbe_rxtx_vec_sse.c index 1eed949495..648ad9eadd 100644 --- a/drivers/net/ixgbe/ixgbe_rxtx_vec_sse.c +++ b/drivers/net/ixgbe/ixgbe_rxtx_vec_sse.c @@ -364,6 +364,12 @@ _recv_raw_pkts_vec(struct ixgbe_rx_queue *rxq, struct rte_mbuf **rx_pkts, uint8_t vlan_flags; uint16_t udp_p_flag =3D 0; /* Rx Descriptor UDP header present */ + /* + * If nb_pkts is greater than the threshold, + * it may cause some unreleased mbuf be reused. + */ + nb_pkts =3D RTE_MIN(nb_pkts, RTE_IXGBE_RXQ_REARM_THRESH); + /* nb_pkts has to be floor-aligned to RTE_IXGBE_DESCS_PER_LOOP */ nb_pkts =3D RTE_ALIGN_FLOOR(nb_pkts, RTE_IXGBE_DESCS_PER_LOOP); The attachment has a corresponding demo to reproduce this bug. Thanks! --=20 You are receiving this mail because: You are the assignee for the bug.=