From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from youngberry.canonical.com (youngberry.canonical.com [91.189.89.112]) by dpdk.org (Postfix) with ESMTP id 8F40923D for ; Mon, 30 Jul 2018 18:19:22 +0200 (CEST) Received: from 1.general.paelzer.uk.vpn ([10.172.196.172] helo=lap.fritz.box) by youngberry.canonical.com with esmtpsa (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.76) (envelope-from ) id 1fkAqj-00009D-0d; Mon, 30 Jul 2018 16:16:45 +0000 From: Christian Ehrhardt To: Andrew Rybchenko Cc: Ivan Malov , dpdk stable Date: Mon, 30 Jul 2018 18:12:04 +0200 Message-Id: <20180730161342.16566-79-christian.ehrhardt@canonical.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20180730161342.16566-1-christian.ehrhardt@canonical.com> References: <20180730161342.16566-1-christian.ehrhardt@canonical.com> Subject: [dpdk-stable] patch 'net/sfc: fix double-free in EF10 ESSB Rx queue purge' has been queued to stable release 18.05.1 X-BeenThere: stable@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: patches for DPDK stable branches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 30 Jul 2018 16:19:22 -0000 Hi, FYI, your patch has been queued to stable release 18.05.1 Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet. It will be pushed if I get no objections before 08/01/18. So please shout if anyone has objections. Thanks. Christian Ehrhardt --- >>From 3af3bae48c9cf96063928ac44720d47f85173d4e Mon Sep 17 00:00:00 2001 From: Andrew Rybchenko Date: Fri, 29 Jun 2018 16:41:06 +0100 Subject: [PATCH] net/sfc: fix double-free in EF10 ESSB Rx queue purge [ upstream commit 20680dae4602d4f71e860c0f7532b1c369aa89b3 ] Number of buffers left in completed descriptor may be 0. If so, all buffers of the descriptor are freed once again. Fixes: 390f9b8d82c9 ("net/sfc: support equal stride super-buffer Rx mode") Signed-off-by: Andrew Rybchenko Reviewed-by: Ivan Malov --- drivers/net/sfc/sfc_ef10_essb_rx.c | 21 ++++++--------------- 1 file changed, 6 insertions(+), 15 deletions(-) diff --git a/drivers/net/sfc/sfc_ef10_essb_rx.c b/drivers/net/sfc/sfc_ef10_essb_rx.c index a3b988fcf..000de2e34 100644 --- a/drivers/net/sfc/sfc_ef10_essb_rx.c +++ b/drivers/net/sfc/sfc_ef10_essb_rx.c @@ -654,29 +654,20 @@ static void sfc_ef10_essb_rx_qpurge(struct sfc_dp_rxq *dp_rxq) { struct sfc_ef10_essb_rxq *rxq = sfc_ef10_essb_rxq_by_dp_rxq(dp_rxq); - unsigned int i, j; + unsigned int i; const struct sfc_ef10_essb_rx_sw_desc *rxd; struct rte_mbuf *m; - if (rxq->completed != rxq->added && rxq->left_in_completed > 0) { - rxd = &rxq->sw_ring[rxq->completed & rxq->rxq_ptr_mask]; - m = sfc_ef10_essb_mbuf_by_index(rxq, rxd->first_mbuf, - rxq->block_size - rxq->left_in_completed); - do { - rxq->left_in_completed--; - rte_mempool_put(rxq->refill_mb_pool, m); - m = sfc_ef10_essb_next_mbuf(rxq, m); - } while (rxq->left_in_completed > 0); - rxq->completed++; - } - for (i = rxq->completed; i != rxq->added; ++i) { rxd = &rxq->sw_ring[i & rxq->rxq_ptr_mask]; - m = rxd->first_mbuf; - for (j = 0; j < rxq->block_size; ++j) { + m = sfc_ef10_essb_mbuf_by_index(rxq, rxd->first_mbuf, + rxq->block_size - rxq->left_in_completed); + while (rxq->left_in_completed > 0) { rte_mempool_put(rxq->refill_mb_pool, m); m = sfc_ef10_essb_next_mbuf(rxq, m); + rxq->left_in_completed--; } + rxq->left_in_completed = rxq->block_size; } rxq->flags &= ~SFC_EF10_ESSB_RXQ_STARTED; -- 2.17.1