DPDK patches and discussions
 help / color / mirror / Atom feed
* [Bug 987] dead lock in rte_acl_creat and rte_ring_free by list circled
@ 2022-03-30 11:34 bugzilla
  0 siblings, 0 replies; only message in thread
From: bugzilla @ 2022-03-30 11:34 UTC (permalink / raw)
  To: dev

https://bugs.dpdk.org/show_bug.cgi?id=987

            Bug ID: 987
           Summary: dead lock in rte_acl_creat and rte_ring_free by list
                    circled
           Product: DPDK
           Version: 20.02
          Hardware: x86
                OS: Linux
            Status: UNCONFIRMED
          Severity: normal
          Priority: Normal
         Component: vhost/virtio
          Assignee: dev@dpdk.org
          Reporter: sofardware@126.com
  Target Milestone: ---

In the function rte_acl_creat or rte_ring_free, when run TAILQ_FOREACH, it can
not end if not find the target, because the tailq list has became  a circle
list, of   
 whitch the last node's next is the first node.
   This issue does not alwayse hapen, and I have not find what result it.

(gdb) disassemble
Dump of assembler code for function rte_acl_create:
   0x00000000006057a0 <+0>:     push   %r15
   0x00000000006057a2 <+2>:     push   %r14
   0x00000000006057a4 <+4>:     push   %r13
   0x00000000006057a6 <+6>:     push   %r12
   0x00000000006057a8 <+8>:     mov    %rdi,%r12
   0x00000000006057ab <+11>:    push   %rbp
   0x00000000006057ac <+12>:    push   %rbx
   0x00000000006057ad <+13>:    sub    $0x38,%rsp
   0x00000000006057b1 <+17>:    test   %rdi,%rdi
   0x00000000006057b4 <+20>:    mov    0x7a2365(%rip),%r13        # 0xda7b20
<rte_acl_tailq>
   0x00000000006057bb <+27>:    je     0x6058f0 <rte_acl_create+336>
   0x00000000006057c1 <+33>:    mov    (%rdi),%rcx
   0x00000000006057c4 <+36>:    test   %rcx,%rcx
   0x00000000006057c7 <+39>:    je     0x6058f0 <rte_acl_create+336>
   0x00000000006057cd <+45>:    lea    0x10(%rsp),%rdi
   0x00000000006057d2 <+50>:    mov    $0xaf5029,%edx
   0x00000000006057d7 <+55>:    mov    $0x20,%esi
   0x00000000006057dc <+60>:    xor    %eax,%eax
   0x00000000006057de <+62>:    callq  0x4395c0 <snprintf@plt>
   0x00000000006057e3 <+67>:    mov    0x10(%r12),%eax
   0x00000000006057e8 <+72>:    mov    0xc(%r12),%r15d
   0x00000000006057ed <+77>:    mov    %eax,0xc(%rsp)
   0x00000000006057f1 <+81>:    callq  0x5b31e0 <rte_mcfg_tailq_write_lock>
   0x00000000006057f6 <+86>:    mov    0x0(%r13),%r14
   0x00000000006057fa <+90>:    test   %r14,%r14
   0x00000000006057fd <+93>:    je     0x605840 <rte_acl_create+160>
   0x00000000006057ff <+95>:    mov    (%r12),%rbp
   0x0000000000605803 <+99>:    jmp    0x605810 <rte_acl_create+112>
   0x0000000000605805 <+101>:   nopl   (%rax)
   0x0000000000605808 <+104>:   mov    (%r14),%r14
   0x000000000060580b <+107>:   test   %r14,%r14
   0x000000000060580e <+110>:   je     0x605840 <rte_acl_create+160>
   0x0000000000605810 <+112>:   mov    0x10(%r14),%rbx
   0x0000000000605814 <+116>:   mov    $0x20,%edx
   0x0000000000605819 <+121>:   mov    %rbp,%rdi
   0x000000000060581c <+124>:   mov    %rbx,%rsi
   0x000000000060581f <+127>:   callq  0x438bc0 <strncmp@plt>
=> 0x0000000000605824 <+132>:   test   %eax,%eax
   0x0000000000605826 <+134>:   jne    0x605808 <rte_acl_create+104>
   0x0000000000605828 <+136>:   callq  0x5b3230 <rte_mcfg_tailq_write_unlock>
   0x000000000060582d <+141>:   mov    %rbx,%rax
   0x0000000000605830 <+144>:   add    $0x38,%rsp
   0x0000000000605834 <+148>:   pop    %rbx
   0x0000000000605835 <+149>:   pop    %rbp
   0x0000000000605836 <+150>:   pop    %r12
   0x0000000000605838 <+152>:   pop    %r13
   0x000000000060583a <+154>:   pop    %r14
   0x000000000060583c <+156>:   pop    %r15
   0x000000000060583e <+158>:   retq   
   0x000000000060583f <+159>:   nop
   0x0000000000605840 <+160>:   xor    %edx,%edx
   0x0000000000605842 <+162>:   mov    $0x18,%esi
   0x0000000000605847 <+167>:   mov    $0xaf5030,%edi
   0x000000000060584c <+172>:   callq  0x5c0460 <rte_zmalloc>
   0x0000000000605851 <+177>:   test   %rax,%rax
   0x0000000000605854 <+180>:   mov    %rax,%rbp
   0x0000000000605857 <+183>:   je     0x605935 <rte_acl_create+405>
---Type <return> to continue, or q <return> to quit--- 
   0x000000000060585d <+189>:   mov    0xc(%rsp),%r14d
   0x0000000000605862 <+194>:   mov    0x8(%r12),%ecx
   0x0000000000605867 <+199>:   lea    0x10(%rsp),%rdi
   0x000000000060586c <+204>:   mov    $0x40,%edx
   0x0000000000605871 <+209>:   imul   %r15d,%r14d
   0x0000000000605875 <+213>:   add    $0x388,%r14
   0x000000000060587c <+220>:   mov    %r14,%rsi
   0x000000000060587f <+223>:   callq  0x5c0380 <rte_zmalloc_socket>
   0x0000000000605884 <+228>:   test   %rax,%rax
   0x0000000000605887 <+231>:   mov    %rax,%rbx
   0x000000000060588a <+234>:   je     0x605905 <rte_acl_create+357>
   0x000000000060588c <+236>:   lea    0x388(%rax),%rax
   0x0000000000605893 <+243>:   mov    (%r12),%rcx
   0x0000000000605897 <+247>:   mov    $0xaecc2d,%edx
   0x000000000060589c <+252>:   mov    $0x20,%esi
   0x00000000006058a1 <+257>:   mov    %rbx,%rdi
   0x00000000006058a4 <+260>:   mov    %rax,0x28(%rbx)
   0x00000000006058a8 <+264>:   mov    0x10(%r12),%eax
   0x00000000006058ad <+269>:   mov    %eax,0x30(%rbx)
   0x00000000006058b0 <+272>:   mov    0xc(%r12),%eax
   0x00000000006058b5 <+277>:   mov    %eax,0x34(%rbx)
   0x00000000006058b8 <+280>:   mov    0x8(%r12),%eax
   0x00000000006058bd <+285>:   mov    %eax,0x20(%rbx)
   0x00000000006058c0 <+288>:   mov    0x7a223a(%rip),%eax        # 0xda7b00
<rte_acl_default_classify>
   0x00000000006058c6 <+294>:   mov    %eax,0x24(%rbx)
   0x00000000006058c9 <+297>:   xor    %eax,%eax
   0x00000000006058cb <+299>:   callq  0x4395c0 <snprintf@plt>
   0x00000000006058d0 <+304>:   mov    0x8(%r13),%rax
   0x00000000006058d4 <+308>:   mov    %rbx,0x10(%rbp)
   0x00000000006058d8 <+312>:   movq   $0x0,0x0(%rbp)
   0x00000000006058e0 <+320>:   mov    %rax,0x8(%rbp)
   0x00000000006058e4 <+324>:   mov    %rbp,(%rax)
   0x00000000006058e7 <+327>:   mov    %rbp,0x8(%r13)
   0x00000000006058eb <+331>:   jmpq   0x605828 <rte_acl_create+136>
   0x00000000006058f0 <+336>:   mov    0x7916f1(%rip),%rax        # 0xd96fe8
   0x00000000006058f7 <+343>:   movl   $0x16,%fs:(%rax)
   0x00000000006058fe <+350>:   xor    %eax,%eax
   0x0000000000605900 <+352>:   jmpq   0x605830 <rte_acl_create+144>
   0x0000000000605905 <+357>:   mov    0x8(%r12),%r8d
   0x000000000060590a <+362>:   lea    0x10(%rsp),%r9
   0x000000000060590f <+367>:   mov    %r14,%rcx
   0x0000000000605912 <+370>:   mov    $0xaf50f0,%edx
   0x0000000000605917 <+375>:   mov    $0x9,%esi
   0x000000000060591c <+380>:   mov    $0x4,%edi
   0x0000000000605921 <+385>:   xor    %eax,%eax
   0x0000000000605923 <+387>:   callq  0x43ebc6 <rte_log>
   0x0000000000605928 <+392>:   mov    %rbp,%rdi
   0x000000000060592b <+395>:   callq  0x5c01b0 <rte_free>
   0x0000000000605930 <+400>:   jmpq   0x605828 <rte_acl_create+136>
   0x0000000000605935 <+405>:   mov    $0xaf50c8,%edx
   0x000000000060593a <+410>:   mov    $0x9,%esi
   0x000000000060593f <+415>:   mov    $0x4,%edi
   0x0000000000605944 <+420>:   xor    %eax,%eax
   0x0000000000605946 <+422>:   xor    %ebx,%ebx
   0x0000000000605948 <+424>:   callq  0x43ebc6 <rte_log>
   0x000000000060594d <+429>:   jmpq   0x605828 <rte_acl_create+136>
End of assembler dump.
(gdb) p $r14
$16 = 8615101376
(gdb) p/x $r14
$17 = 0x2018003c0
(gdb) p/x *((long long*)0x2018003c0)
$18 = 0xf9d5e00
(gdb) p/x *((long long*)0xf9d5e00)
$19 = 0x1b1a00200
(gdb) p/x *((long long*)0x1b1a00200)
$20 = 0x201800540
(gdb) p/x *((long long*)0x201800540)
$21 = 0x2018003c0
(gdb) p/x *((long long*)0x2018003c0)
$22 = 0xf9d5e00
------------------------------------------------------
Dump of assembler code for function rte_ring_free:
   0x00000000005cbb00 <+0>:     push   %r12
   0x00000000005cbb02 <+2>:     test   %rdi,%rdi                               
     //判断第一个参数r 是否为NULL
   0x00000000005cbb05 <+5>:     push   %rbp
   0x00000000005cbb06 <+6>:     mov    %rdi,%rbp
   0x00000000005cbb09 <+9>:     push   %rbx
   0x00000000005cbb0a <+10>:    je     0x5cbb98 <rte_ring_free+152>            
     //如果第一个参数为NULL,调到152帧,函数返回
   0x00000000005cbb10 <+16>:    mov    0x28(%rdi),%rdi                         
     //取r->memzone的值
   0x00000000005cbb14 <+20>:    test   %rdi,%rdi
   0x00000000005cbb17 <+23>:    je     0x5cbbb7 <rte_ring_free+183>            
     //判断r->memzone是否为NULL,如果是,则调到183帧返回。
   0x00000000005cbb1d <+29>:    callq  0x5b2290 <rte_memzone_free>             
     //如果 r->memzone不为NULL,则释放r->memzone
   0x00000000005cbb22 <+34>:    test   %eax,%eax                               
     //如果是否失败,调到157帧返回
   0x00000000005cbb24 <+36>:    jne    0x5cbb9d <rte_ring_free+157>
   0x00000000005cbb26 <+38>:    mov    0x7db973(%rip),%r12        # 0xda74a0
<rte_ring_tailq>  //获取rte_ring链表
   0x00000000005cbb2d <+45>:    callq  0x5b31e0 <rte_mcfg_tailq_write_lock>
   0x00000000005cbb32 <+50>:    mov    (%r12),%rbx  //(var) =
((head)->tqh_first)    //获取链表第一个节点
   0x00000000005cbb36 <+54>:    test   %rbx,%rbx                               
     //判断该节点是否为空
   0x00000000005cbb39 <+57>:    jne    0x5cbb48 <rte_ring_free+72>             
     //如何不为空,跳到72帧判断数据是否等于待删除节点。
   0x00000000005cbb3b <+59>:    jmp    0x5cbb80 <rte_ring_free+128>            
     //如果为空,跳到128帧,解锁返回
   0x00000000005cbb3d <+61>:    nopl   (%rax)
=> 0x00000000005cbb40 <+64>:    mov    (%rbx),%rbx                             
     //取下一个节点
   0x00000000005cbb43 <+67>:    test   %rbx,%rbx                               
     //判断该节点是否为空
   0x00000000005cbb46 <+70>:    je     0x5cbb80 <rte_ring_free+128> if         
     //如果为空,跳到128帧,解锁返回。
   0x00000000005cbb48 <+72>:    cmp    %rbp,0x10(%rbx)  //var = ring           
     //当前所取的节点中的数据是否等于待删除节点
   0x00000000005cbb4c <+76>:    jne    0x5cbb40 <rte_ring_free+64>             
     // 如果不等,跳到64帧继续取下一个节点
   0x00000000005cbb4e <+78>:    mov    (%rbx),%rax
   0x00000000005cbb51 <+81>:    test   %rax,%rax                               
     //判断当前节点是否为空,也就是说是否链表轮询到末尾了仍未找到和待删除节点相等的节点。
   0x00000000005cbb54 <+84>:    je     0x5cbb89 <rte_ring_free+137>            
     //如果为空,则解锁返回。否则删除节点后解锁,再是否内存,再返回。
   0x00000000005cbb56 <+86>:    mov    0x8(%rbx),%rdx                          
     //这里代表所取的节点中的数据等于待删除节点, 从链表删除节点。
   0x00000000005cbb5a <+90>:    mov    %rdx,0x8(%rax)
   0x00000000005cbb5e <+94>:    mov    0x8(%rbx),%rdx
   0x00000000005cbb62 <+98>:    mov    %rax,(%rdx)
   0x00000000005cbb65 <+101>:   callq  0x5b3230 <rte_mcfg_tailq_write_unlock>  
     //解锁
   0x00000000005cbb6a <+106>:   mov    %rbx,%rdi
   0x00000000005cbb6d <+109>:   pop    %rbx
   0x00000000005cbb6e <+110>:   pop    %rbp
   0x00000000005cbb6f <+111>:   pop    %r12
   0x00000000005cbb71 <+113>:   jmpq   0x5c01b0 <rte_free>                     
    //释放内存,返回
   0x00000000005cbb76 <+118>:   nopw   %cs:0x0(%rax,%rax,1)
   0x00000000005cbb80 <+128>:   pop    %rbx
   0x00000000005cbb81 <+129>:   pop    %rbp
   0x00000000005cbb82 <+130>:   pop    %r12
   0x00000000005cbb84 <+132>:   jmpq   0x5b3230 <rte_mcfg_tailq_write_unlock>
   0x00000000005cbb89 <+137>:   mov    0x8(%rbx),%rdx
   0x00000000005cbb8d <+141>:   mov    %rdx,0x8(%r12)
   0x00000000005cbb92 <+146>:   jmp    0x5cbb62 <rte_ring_free+98>
   0x00000000005cbb94 <+148>:   nopl   0x0(%rax)
   0x00000000005cbb98 <+152>:   pop    %rbx
   0x00000000005cbb99 <+153>:   pop    %rbp
   0x00000000005cbb9a <+154>:   pop    %r12
   0x00000000005cbb9c <+156>:   retq   
   0x00000000005cbb9d <+157>:   mov    $0xaecad3,%edx
   0x00000000005cbba2 <+162>:   mov    $0x2,%esi
   0x00000000005cbba7 <+167>:   mov    $0x4,%edi
   0x00000000005cbbac <+172>:   pop    %rbx
   0x00000000005cbbad <+173>:   pop    %rbp
   0x00000000005cbbae <+174>:   pop    %r12
   0x00000000005cbbb0 <+176>:   xor    %eax,%eax  
   0x00000000005cbbb2 <+178>:   jmpq   0x43ebc6 <rte_log>
   0x00000000005cbbb7 <+183>:   mov    $0xaeca60,%edx
   0x00000000005cbbbc <+188>:   mov    $0x2,%esi
   0x00000000005cbbc1 <+193>:   mov    $0x4,%dil
   0x00000000005cbbc4 <+196>:   jmp    0x5cbbac <rte_ring_free+172>

(gdb) p/x *(long long *)0x1b2004840
$26 = 0x299a01480
(gdb) p/x *(long long *)0x299a01480    
$27 = 0xf9d5e00
(gdb) p/x *(long long *)0xf9d5e00  
$28 = 0x1b2004840

-- 
You are receiving this mail because:
You are the assignee for the bug.

^ permalink raw reply	[flat|nested] only message in thread

only message in thread, other threads:[~2022-03-30 11:34 UTC | newest]

Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-03-30 11:34 [Bug 987] dead lock in rte_acl_creat and rte_ring_free by list circled bugzilla

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).