From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from dpdk.org (dpdk.org [92.243.14.124]) by inbox.dpdk.org (Postfix) with ESMTP id 84900A0597; Thu, 9 Apr 2020 11:52:26 +0200 (CEST) Received: from [92.243.14.124] (localhost [127.0.0.1]) by dpdk.org (Postfix) with ESMTP id 6F7911C1FD; Thu, 9 Apr 2020 11:52:25 +0200 (CEST) Received: from mga07.intel.com (mga07.intel.com [134.134.136.100]) by dpdk.org (Postfix) with ESMTP id E9AD51C1FB; Thu, 9 Apr 2020 11:52:23 +0200 (CEST) IronPort-SDR: e46zRiPOrTAysI7D3hcl8gxdU7FpC/mjzPJzhYrmqC/aPz+cVwFogAosKgL2zDd3yvruq3Mg+G SDC6bcz1rqoQ== X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga003.fm.intel.com ([10.253.24.29]) by orsmga105.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 09 Apr 2020 02:52:22 -0700 IronPort-SDR: ER6sVGKJvujcKiJO5zLKfWyjsqdEb78/0jPvNtnlTCCe9VcQ3KjLSFrHtPDm3DPj/0LEL1plkG XstsSYpHmgEA== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.72,362,1580803200"; d="scan'208";a="297484450" Received: from fyigit-mobl.ger.corp.intel.com (HELO [10.252.7.25]) ([10.252.7.25]) by FMSMGA003.fm.intel.com with ESMTP; 09 Apr 2020 02:52:20 -0700 To: wangyunjian , "dev@dpdk.org" Cc: "keith.wiles@intel.com" , "Lilijun (Jerry)" , xudingke , "stable@dpdk.org" References: <1586233357-2580-1-git-send-email-wangyunjian@huawei.com> <34EFBCA9F01B0748BEB6B629CE643AE60CF5FDB2@DGGEMM533-MBX.china.huawei.com> From: Ferruh Yigit Autocrypt: addr=ferruh.yigit@intel.com; prefer-encrypt=mutual; keydata= mQINBFXZCFABEADCujshBOAaqPZpwShdkzkyGpJ15lmxiSr3jVMqOtQS/sB3FYLT0/d3+bvy qbL9YnlbPyRvZfnP3pXiKwkRoR1RJwEo2BOf6hxdzTmLRtGtwWzI9MwrUPj6n/ldiD58VAGQ +iR1I/z9UBUN/ZMksElA2D7Jgg7vZ78iKwNnd+vLBD6I61kVrZ45Vjo3r+pPOByUBXOUlxp9 GWEKKIrJ4eogqkVNSixN16VYK7xR+5OUkBYUO+sE6etSxCr7BahMPKxH+XPlZZjKrxciaWQb +dElz3Ab4Opl+ZT/bK2huX+W+NJBEBVzjTkhjSTjcyRdxvS1gwWRuXqAml/sh+KQjPV1PPHF YK5LcqLkle+OKTCa82OvUb7cr+ALxATIZXQkgmn+zFT8UzSS3aiBBohg3BtbTIWy51jNlYdy ezUZ4UxKSsFuUTPt+JjHQBvF7WKbmNGS3fCid5Iag4tWOfZoqiCNzxApkVugltxoc6rG2TyX CmI2rP0mQ0GOsGXA3+3c1MCdQFzdIn/5tLBZyKy4F54UFo35eOX8/g7OaE+xrgY/4bZjpxC1 1pd66AAtKb3aNXpHvIfkVV6NYloo52H+FUE5ZDPNCGD0/btFGPWmWRmkPybzColTy7fmPaGz cBcEEqHK4T0aY4UJmE7Ylvg255Kz7s6wGZe6IR3N0cKNv++O7QARAQABtCVGZXJydWggWWln aXQgPGZlcnJ1aC55aWdpdEBpbnRlbC5jb20+iQJUBBMBCgA+AhsDAh4BAheABQsJCAcDBRUK CQgLBRYCAwEAFiEE0jZTh0IuwoTjmYHH+TPrQ98TYR8FAl1meboFCQlupOoACgkQ+TPrQ98T YR9ACBAAv2tomhyxY0Tp9Up7mNGLfEdBu/7joB/vIdqMRv63ojkwr9orQq5V16V/25+JEAD0 60cKodBDM6HdUvqLHatS8fooWRueSXHKYwJ3vxyB2tWDyZrLzLI1jxEvunGodoIzUOtum0Ce gPynnfQCelXBja0BwLXJMplM6TY1wXX22ap0ZViC0m714U5U4LQpzjabtFtjT8qOUR6L7hfy YQ72PBuktGb00UR/N5UrR6GqB0x4W41aZBHXfUQnvWIMmmCrRUJX36hOTYBzh+x86ULgg7H2 1499tA4o6rvE13FiGccplBNWCAIroAe/G11rdoN5NBgYVXu++38gTa/MBmIt6zRi6ch15oLA Ln2vHOdqhrgDuxjhMpG2bpNE36DG/V9WWyWdIRlz3NYPCDM/S3anbHlhjStXHOz1uHOnerXM 1jEjcsvmj1vSyYoQMyRcRJmBZLrekvgZeh7nJzbPHxtth8M7AoqiZ/o/BpYU+0xZ+J5/szWZ aYxxmIRu5ejFf+Wn9s5eXNHmyqxBidpCWvcbKYDBnkw2+Y9E5YTpL0mS0dCCOlrO7gca27ux ybtbj84aaW1g0CfIlUnOtHgMCmz6zPXThb+A8H8j3O6qmPoVqT3qnq3Uhy6GOoH8Fdu2Vchh TWiF5yo+pvUagQP6LpslffufSnu+RKAagkj7/RSuZV25Ag0EV9ZMvgEQAKc0Db17xNqtSwEv mfp4tkddwW9XA0tWWKtY4KUdd/jijYqc3fDD54ESYpV8QWj0xK4YM0dLxnDU2IYxjEshSB1T qAatVWz9WtBYvzalsyTqMKP3w34FciuL7orXP4AibPtrHuIXWQOBECcVZTTOdZYGAzaYzxiA ONzF9eTiwIqe9/oaOjTwTLnOarHt16QApTYQSnxDUQljeNvKYt1lZE/gAUUxNLWsYyTT+22/ vU0GDUahsJxs1+f1yEr+OGrFiEAmqrzpF0lCS3f/3HVTU6rS9cK3glVUeaTF4+1SK5ZNO35p iVQCwphmxa+dwTG/DvvHYCtgOZorTJ+OHfvCnSVjsM4kcXGjJPy3JZmUtyL9UxEbYlrffGPQ I3gLXIGD5AN5XdAXFCjjaID/KR1c9RHd7Oaw0Pdcq9UtMLgM1vdX8RlDuMGPrj5sQrRVbgYH fVU/TQCk1C9KhzOwg4Ap2T3tE1umY/DqrXQgsgH71PXFucVjOyHMYXXugLT8YQ0gcBPHy9mZ qw5mgOI5lCl6d4uCcUT0l/OEtPG/rA1lxz8ctdFBVOQOxCvwRG2QCgcJ/UTn5vlivul+cThi 6ERPvjqjblLncQtRg8izj2qgmwQkvfj+h7Ex88bI8iWtu5+I3K3LmNz/UxHBSWEmUnkg4fJl Rr7oItHsZ0ia6wWQ8lQnABEBAAGJAjwEGAEKACYCGwwWIQTSNlOHQi7ChOOZgcf5M+tD3xNh HwUCXWZ5wAUJB3FgggAKCRD5M+tD3xNhH2O+D/9OEz62YuJQLuIuOfL67eFTIB5/1+0j8Tsu o2psca1PUQ61SZJZOMl6VwNxpdvEaolVdrpnSxUF31kPEvR0Igy8HysQ11pj8AcgH0a9FrvU /8k2Roccd2ZIdpNLkirGFZR7LtRw41Kt1Jg+lafI0efkiHKMT/6D/P1EUp1RxOBNtWGV2hrd 0Yg9ds+VMphHHU69fDH02SwgpvXwG8Qm14Zi5WQ66R4CtTkHuYtA63sS17vMl8fDuTCtvfPF HzvdJLIhDYN3Mm1oMjKLlq4PUdYh68Fiwm+boJoBUFGuregJFlO3hM7uHBDhSEnXQr5mqpPM 6R/7Q5BjAxrwVBisH0yQGjsWlnysRWNfExAE2sRePSl0or9q19ddkRYltl6X4FDUXy2DTXa9 a+Fw4e1EvmcF3PjmTYs9IE3Vc64CRQXkhujcN4ZZh5lvOpU8WgyDxFq7bavFnSS6kx7Tk29/ wNJBp+cf9qsQxLbqhW5kfORuZGecus0TLcmpZEFKKjTJBK9gELRBB/zoN3j41hlEl7uTUXTI JQFLhpsFlEdKLujyvT/aCwP3XWT+B2uZDKrMAElF6ltpTxI53JYi22WO7NH7MR16Fhi4R6vh FHNBOkiAhUpoXRZXaCR6+X4qwA8CwHGqHRBfYFSU/Ulq1ZLR+S3hNj2mbnSx0lBs1eEqe2vh cA== Message-ID: Date: Thu, 9 Apr 2020 10:52:19 +0100 MIME-Version: 1.0 In-Reply-To: <34EFBCA9F01B0748BEB6B629CE643AE60CF5FDB2@DGGEMM533-MBX.china.huawei.com> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 8bit Subject: Re: [dpdk-dev] [dpdk-stable] [PATCH v3 1/5] net/tap: fix mbuf double free when writev fails X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" On 4/9/2020 9:03 AM, wangyunjian wrote: > > >> -----Original Message----- >> From: Ferruh Yigit [mailto:ferruh.yigit@intel.com] >> Sent: Tuesday, April 7, 2020 8:35 PM >> To: wangyunjian ; dev@dpdk.org >> Cc: keith.wiles@intel.com; Lilijun (Jerry) ; xudingke >> ; stable@dpdk.org >> Subject: Re: [dpdk-stable] [dpdk-dev] [PATCH v3 1/5] net/tap: fix mbuf double >> free when writev fails >> >> On 4/7/2020 5:22 AM, wangyunjian wrote: >>> From: Yunjian Wang >>> >>> When the tap_write_mbufs() function return with break, mbuf was freed >>> without incrementing num_packets. This may lead applications also free >>> the mbuf. And the pmd_tx_burst() function should returns the number of >>> original packets it actually sent excluding tso mbufs. >>> >>> Fixes: 9396ad334672 ("net/tap: fix reported number of Tx packets") >>> CC: stable@dpdk.org >>> >>> Signed-off-by: Yunjian Wang >>> --- >>> drivers/net/tap/rte_eth_tap.c | 21 +++++++++++++++------ >>> 1 file changed, 15 insertions(+), 6 deletions(-) >>> >>> diff --git a/drivers/net/tap/rte_eth_tap.c >>> b/drivers/net/tap/rte_eth_tap.c index 05470a211..4c4b6b0b2 100644 >>> --- a/drivers/net/tap/rte_eth_tap.c >>> +++ b/drivers/net/tap/rte_eth_tap.c >>> @@ -521,7 +521,7 @@ tap_tx_l3_cksum(char *packet, uint64_t ol_flags, >> unsigned int l2_len, >>> } >>> } >>> >>> -static inline void >>> +static inline int >>> tap_write_mbufs(struct tx_queue *txq, uint16_t num_mbufs, >>> struct rte_mbuf **pmbufs, >>> uint16_t *num_packets, unsigned long *num_tx_bytes) @@ >> -588,7 >>> +588,7 @@ tap_write_mbufs(struct tx_queue *txq, uint16_t num_mbufs, >>> seg_len = rte_pktmbuf_data_len(mbuf); >>> l234_hlen = mbuf->l2_len + mbuf->l3_len + mbuf->l4_len; >>> if (seg_len < l234_hlen) >>> - break; >>> + return -1; >>> >>> /* To change checksums, work on a * copy of l2, l3 >>> * headers + l4 pseudo header >>> @@ -634,10 +634,12 @@ tap_write_mbufs(struct tx_queue *txq, uint16_t >> num_mbufs, >>> /* copy the tx frame data */ >>> n = writev(process_private->txq_fds[txq->queue_id], iovecs, j); >>> if (n <= 0) >>> - break; >>> + return -1; >>> + >>> (*num_packets)++; >>> (*num_tx_bytes) += rte_pktmbuf_pkt_len(mbuf); >>> } >>> + return 0; >>> } >>> >>> /* Callback to handle sending packets from the tap interface @@ >>> -708,8 +710,15 @@ pmd_tx_burst(void *queue, struct rte_mbuf **bufs, >> uint16_t nb_pkts) >>> num_mbufs = 1; >>> } >>> >>> - tap_write_mbufs(txq, num_mbufs, mbuf, >>> - &num_packets, &num_tx_bytes); >>> + ret = tap_write_mbufs(txq, num_mbufs, mbuf, >>> + &num_packets, &num_tx_bytes); >> >> reusing 'ret' here breaks the logic at the end of the loop that free tso mbufs, >> which expects 'ret' is number of mbufs in tso case. >> >>> + if (ret != 0) { >>> + txq->stats.errs++; >>> + /* free tso mbufs */ >>> + for (j = 0; j < ret; j++) >> >> 'ret' only can be '0' or '-1', and we take the branch only when it is '-1', so this >> block is not used at all and it doesn't free any mbuf. > > I'm sorry for my mistakes. I will fix it in next version. > what about following: > > error = tap_write_mbufs(txq, num_mbufs, mbuf, > &num_packets, &num_tx_bytes); > if (error == -1) { > txq->stats.errs++; > /* free tso mbufs */ > for (j = 0; j < ret; j++) > rte_pktmbuf_free(mbuf[j]); > break; > } +1, but still needs to free the 'mbuf_in' before break. Or maybe it is better to create a new variable like 'num_tso_mbufs' and use it instead of 'ret', which is more readable, and this enables to reuse the 'ret'. > > Thanks > Yunjian >>> + rte_pktmbuf_free(mbuf[j]); >> >> >> In the no tso case, if the 'tap_write_mbufs()' fails, this doesn't free the >> 'mbuf_in'. >> >>> + break; >>> + } >>> num_tx++; >>> /* free original mbuf */ >>> rte_pktmbuf_free(mbuf_in); >>> @@ -722,7 +731,7 @@ pmd_tx_burst(void *queue, struct rte_mbuf **bufs, >> uint16_t nb_pkts) >>> txq->stats.errs += nb_pkts - num_tx; >>> txq->stats.obytes += num_tx_bytes; >>> >>> - return num_packets; >>> + return num_tx; >> >> +1 to return number of original packets. >> >>> } >>> >>> static const char * >>> >