From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mga05.intel.com (mga05.intel.com [192.55.52.43]) by dpdk.org (Postfix) with ESMTP id B44452C72; Wed, 19 Apr 2017 07:29:09 +0200 (CEST) Received: from fmsmga004.fm.intel.com ([10.253.24.48]) by fmsmga105.fm.intel.com with ESMTP; 18 Apr 2017 22:29:08 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.37,219,1488873600"; d="scan'208";a="250849201" Received: from yliu-dev.sh.intel.com ([10.239.67.162]) by fmsmga004.fm.intel.com with ESMTP; 18 Apr 2017 22:29:08 -0700 From: Yuanhan Liu To: dev@dpdk.org Cc: Maxime Coquelin , Yuanhan Liu , stable@dpdk.org Date: Wed, 19 Apr 2017 13:26:01 +0800 Message-Id: <1492579561-19619-1-git-send-email-yuanhan.liu@linux.intel.com> X-Mailer: git-send-email 1.9.0 Subject: [dpdk-stable] [PATCH] vhost: fix dequeue zero copy X-BeenThere: stable@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: patches for DPDK stable branches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 19 Apr 2017 05:29:10 -0000 For zero copy mode, we need pin the mbuf to not let the underlaying PMD driver (or the app) free the mbuf. Currently, only the heading mbuf is pinned. However, the mbuf free function would try to free all mbufs in the mbuf chain (-1 to the refcnt). This may lead the head mbuf being still pinned, while the other subsequent mbufs are actually freed. Which is wrong. It becomes more fatal after the mbuf refactor, more specificly, after the commit 8f094a9ac5d7 ("mbuf: set mbuf fields while in pool"). The refcnt resets to 1 after the last real reference. OTOH, it leads to a situtation that we never know one mbuf is actually freed or not. This would result the mbuf __just__ after the heading mbuf being freed twice: it's firstly freed (and put back to mempool) when the underlaying PMD finishes the DMA. Later, it will then be freed again when vhost unpins it. Meaning, one mbuf may be returned to the mempool twice, while in turn, being allocated twice later. Something uncertain may happen then. For example, the VM2VM case becomes broken. Fixes: b0a985d1f340 ("vhost: add dequeue zero copy") Cc: stable@dpdk.org Signed-off-by: Yuanhan Liu --- lib/librte_vhost/virtio_net.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/lib/librte_vhost/virtio_net.c b/lib/librte_vhost/virtio_net.c index b9f2168..d3d4424 100644 --- a/lib/librte_vhost/virtio_net.c +++ b/lib/librte_vhost/virtio_net.c @@ -871,6 +871,8 @@ static inline int __attribute__((always_inline)) "allocate memory for mbuf.\n"); return -1; } + if (unlikely(dev->dequeue_zero_copy)) + rte_mbuf_refcnt_update(cur, 1); prev->next = cur; prev->data_len = mbuf_offset; -- 1.9.0