[PATCH 0/3] fix wrong increment of free list counter

[PATCH 0/3] fix wrong increment of free list counter

[Chaoyong He]

The wrong increment of free list counter occurs three different place,
and is imported by different commit.

Chaoyong He (3):
  net/nfp: fix wrong increment of free list counter
  net/nfp: fix wrong increment of free list counter for PF
  net/nfp: fix wrong increment of free list counter for VNIC

 drivers/net/nfp/flower/nfp_flower.c      | 3 +--
 drivers/net/nfp/flower/nfp_flower_ctrl.c | 3 +--
 drivers/net/nfp/nfp_rxtx.c               | 3 +--
 3 files changed, 3 insertions(+), 6 deletions(-)

-- 
2.29.3

[PATCH 1/3] net/nfp: fix wrong increment of free list counter

[Chaoyong He]

When receiving a packet that is larger than the mbuf size, the Rx
function will break the receive loop and sent a free list descriptor
with random DMA address.

Fix this by moving the increment of the free list descriptor counter
to after the packet size have been checked and acted on.

Fixes: bb340f56fcb7 ("net/nfp: fix memory leak in Rx")
Cc: long.wu@corigine.com
Cc: stable@dpdk.org

Signed-off-by: Chaoyong He <chaoyong.he@corigine.com>
Reviewed-by: Niklas Söderlund <niklas.soderlund@corigine.com>
---
 drivers/net/nfp/nfp_rxtx.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/net/nfp/nfp_rxtx.c b/drivers/net/nfp/nfp_rxtx.c
index b8c874d315..38377ca218 100644
--- a/drivers/net/nfp/nfp_rxtx.c
+++ b/drivers/net/nfp/nfp_rxtx.c
@@ -293,8 +293,6 @@ nfp_net_recv_pkts(void *rx_queue, struct rte_mbuf **rx_pkts, uint16_t nb_pkts)
 			break;
 		}
 
-		nb_hold++;
-
 		/*
 		 * Grab the mbuf and refill the descriptor with the
 		 * previously allocated mbuf
@@ -365,6 +363,7 @@ nfp_net_recv_pkts(void *rx_queue, struct rte_mbuf **rx_pkts, uint16_t nb_pkts)
 		rxds->fld.dd = 0;
 		rxds->fld.dma_addr_hi = (dma_addr >> 32) & 0xff;
 		rxds->fld.dma_addr_lo = dma_addr & 0xffffffff;
+		nb_hold++;
 
 		rxq->rd_p++;
 		if (unlikely(rxq->rd_p == rxq->rx_count)) /* wrapping?*/
-- 
2.29.3

[PATCH 2/3] net/nfp: fix wrong increment of free list counter for PF

[Chaoyong He]

When using flower firmware application, and the PF receiving a packet
that is larger than the mbuf size, the Rx function will break the
receive loop and sent a free list descriptor with random DMA address.

Fix this by moving the increment of the free list descriptor counter
to after the packet size have been checked and acted on.

Fixes: cf559c2a1d2a ("net/nfp: add flower PF Rx/Tx")

Signed-off-by: Chaoyong He <chaoyong.he@corigine.com>
Reviewed-by: Niklas Söderlund <niklas.soderlund@corigine.com>
---
 drivers/net/nfp/flower/nfp_flower.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/net/nfp/flower/nfp_flower.c b/drivers/net/nfp/flower/nfp_flower.c
index aa8199dde2..e447258d97 100644
--- a/drivers/net/nfp/flower/nfp_flower.c
+++ b/drivers/net/nfp/flower/nfp_flower.c
@@ -369,8 +369,6 @@ nfp_flower_pf_recv_pkts(void *rx_queue,
 			break;
 		}
 
-		nb_hold++;
-
 		/*
 		 * Grab the mbuf and refill the descriptor with the
 		 * previously allocated mbuf
@@ -455,6 +453,7 @@ nfp_flower_pf_recv_pkts(void *rx_queue,
 		rxds->fld.dd = 0;
 		rxds->fld.dma_addr_hi = (dma_addr >> 32) & 0xff;
 		rxds->fld.dma_addr_lo = dma_addr & 0xffffffff;
+		nb_hold++;
 
 		rxq->rd_p++;
 		if (unlikely(rxq->rd_p == rxq->rx_count))
-- 
2.29.3

[PATCH 3/3] net/nfp: fix wrong increment of free list counter for VNIC

[Chaoyong He]

When using flower firmware application, and the ctrl vNIC receiving a
packet that is larger than the mbuf size, the Rx function will break the
receive loop and sent a free list descriptor with random DMA address.

Fix this by moving the increment of the free list descriptor counter
to after the packet size have been checked and acted on.

Fixes: a36634e87e16 ("net/nfp: add flower ctrl VNIC Rx/Tx")

Signed-off-by: Chaoyong He <chaoyong.he@corigine.com>
Reviewed-by: Niklas Söderlund <niklas.soderlund@corigine.com>
---
 drivers/net/nfp/flower/nfp_flower_ctrl.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/net/nfp/flower/nfp_flower_ctrl.c b/drivers/net/nfp/flower/nfp_flower_ctrl.c
index 953ab6e98c..3631e764fe 100644
--- a/drivers/net/nfp/flower/nfp_flower_ctrl.c
+++ b/drivers/net/nfp/flower/nfp_flower_ctrl.c
@@ -74,8 +74,6 @@ nfp_flower_ctrl_vnic_recv(void *rx_queue,
 			break;
 		}
 
-		nb_hold++;
-
 		/*
 		 * Grab the mbuf and refill the descriptor with the
 		 * previously allocated mbuf
@@ -127,6 +125,7 @@ nfp_flower_ctrl_vnic_recv(void *rx_queue,
 		rxds->fld.dd = 0;
 		rxds->fld.dma_addr_hi = (dma_addr >> 32) & 0xff;
 		rxds->fld.dma_addr_lo = dma_addr & 0xffffffff;
+		nb_hold++;
 
 		rxq->rd_p++;
 		if (unlikely(rxq->rd_p == rxq->rx_count)) /* wrapping?*/
-- 
2.29.3

Re: [PATCH 1/3] net/nfp: fix wrong increment of free list counter

[Ferruh Yigit]

On 11/18/2022 1:44 AM, Chaoyong He wrote:
> When receiving a packet that is larger than the mbuf size, the Rx
> function will break the receive loop and sent a free list descriptor
> with random DMA address.
> 
> Fix this by moving the increment of the free list descriptor counter
> to after the packet size have been checked and acted on.
> 

Issue seems one of the Rx descriptor is not rearmed properly and may
have random DMA address, which can lead HW to DMA this random address,
so implications can be dangerous.

I suggest updating patch title slightly to highlight the impact:
"net/nfp: fix Rx descriptor DMA address"

> Fixes: bb340f56fcb7 ("net/nfp: fix memory leak in Rx")
> Cc: long.wu@corigine.com
> Cc: stable@dpdk.org
> 
> Signed-off-by: Chaoyong He <chaoyong.he@corigine.com>
> Reviewed-by: Niklas Söderlund <niklas.soderlund@corigine.com>

Series applied to dpdk-next-net/main, thanks.