From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from dpdk.org (dpdk.org [92.243.14.124]) by inbox.dpdk.org (Postfix) with ESMTP id A0B8AA0093 for ; Tue, 19 May 2020 15:10:48 +0200 (CEST) Received: from [92.243.14.124] (localhost [127.0.0.1]) by dpdk.org (Postfix) with ESMTP id 9641B1D6A4; Tue, 19 May 2020 15:10:48 +0200 (CEST) Received: from mail-wr1-f68.google.com (mail-wr1-f68.google.com [209.85.221.68]) by dpdk.org (Postfix) with ESMTP id 1AB891D6F2 for ; Tue, 19 May 2020 15:10:47 +0200 (CEST) Received: by mail-wr1-f68.google.com with SMTP id e1so15860688wrt.5 for ; Tue, 19 May 2020 06:10:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=p5lDd5HjlQDw6s/hTH77rQKZaNK//NxW+08olJX0kR4=; b=dPLEUe0hIIbsKMrkEBWFAIzlKONj9iELzW8NDyz9u7Tn6c7UECnSRC3YDWsd5krsQj zxyMgVw3bRiajKZF/1dJ8cSrV0I0YiuNW4DRLFNhlMTn750WD59Df1S62Bir9QQYsbYA KckqtaTfYIeBSW0YYB9VdnDbENHqYTFOFJA6JEd7C5wtRRTIwcwBp4dxWUVIKjd/gG1/ qZ0GmTYHNiHMxSB2QtWXOfUGAsYGyb7cvP7HB8xISJ02/T/xQc/8ALA5IYIUgFR/UIXV 98Ba8NJXWW96uQjKcRvWwj+3llZRnL/YL7MzkmwkmJgqnbyWBhHX557MVjPQVl+BwNwF XD+w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=p5lDd5HjlQDw6s/hTH77rQKZaNK//NxW+08olJX0kR4=; b=jbxb+HxAbAdVqXg2hfGDFWnjtZkYAWK+oL4i8XkXNR67Ta/O+Xb0tF5wrwH5RfkSb0 F+VzrsuPzGwMz9w09ryGLWY4Xb3hyyrWOElDM3j98UtGFtqo2DpL//Zzuv5Kid5nmZo+ tjuIcvpo3u66CIW5sbO/WfggY0aK0+nyoipNSZFzLipJ+HUTH+zUHs9CdbipSWA6W52H 9CAhhLRyHOb4ia9M52qkDcmIc1Qv4FbRleBHrIgIx3H5CMLGBgEFmk3R0bZaFuuYQ1LO /fYb2cOc4Rc8D+keJr/ocLXyHT/eV780n6ic2mAJob4pTMa76uNxXjo/BOZ/q0RyrNkV MNJw== X-Gm-Message-State: AOAM530l+2RuX6R7ziYvEfJ8mFzzSpJT5i8+2Bx/VyDQoHAg1phjxuD9 QpGIf8OfTh1FhzTli0b2wIs= X-Google-Smtp-Source: ABdhPJxwJkC3evQdTrB9BwAFt/UZuL/yvmJb/74VT+uI12mDcuptpAwA2wS2OJx+ZMyeAr53yq6dBg== X-Received: by 2002:a05:6000:81:: with SMTP id m1mr25896829wrx.59.1589893846556; Tue, 19 May 2020 06:10:46 -0700 (PDT) Received: from localhost ([88.98.246.218]) by smtp.gmail.com with ESMTPSA id c140sm3999027wmd.18.2020.05.19.06.10.45 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 19 May 2020 06:10:45 -0700 (PDT) From: luca.boccassi@gmail.com To: Yunjian Wang Cc: Ferruh Yigit , Stephen Hemminger , dpdk stable Date: Tue, 19 May 2020 14:03:48 +0100 Message-Id: <20200519130549.112823-93-luca.boccassi@gmail.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20200519130549.112823-1-luca.boccassi@gmail.com> References: <20200519125804.104349-1-luca.boccassi@gmail.com> <20200519130549.112823-1-luca.boccassi@gmail.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Subject: [dpdk-stable] patch 'net/tap: fix mbuf double free when writev fails' has been queued to stable release 19.11.3 X-BeenThere: stable@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: patches for DPDK stable branches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: stable-bounces@dpdk.org Sender: "stable" Hi, FYI, your patch has been queued to stable release 19.11.3 Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet. It will be pushed if I get no objections before 05/21/20. So please shout if anyone has objections. Also note that after the patch there's a diff of the upstream commit vs the patch applied to the branch. This will indicate if there was any rebasing needed to apply to the stable branch. If there were code changes for rebasing (ie: not only metadata diffs), please double check that the rebase was correctly done. Thanks. Luca Boccassi --- >From 908866e6fc81fb9cfd6e36518be56b0f6fe3f0e3 Mon Sep 17 00:00:00 2001 From: Yunjian Wang Date: Thu, 16 Apr 2020 11:04:07 +0800 Subject: [PATCH] net/tap: fix mbuf double free when writev fails [ upstream commit 24cb500c17c6914fce4c8df278b06966d70b897d ] When the tap_write_mbufs() function return with break, mbuf was freed without increasing num_packets, which could cause applications to free the mbuf again. And the pmd_tx_burst() function should returns the number of original packets it actually sent excluding tso mbufs. Fixes: 9396ad334672 ("net/tap: fix reported number of Tx packets") Signed-off-by: Yunjian Wang Reviewed-by: Ferruh Yigit Acked-by: Stephen Hemminger --- drivers/net/tap/rte_eth_tap.c | 34 ++++++++++++++++++++++------------ 1 file changed, 22 insertions(+), 12 deletions(-) diff --git a/drivers/net/tap/rte_eth_tap.c b/drivers/net/tap/rte_eth_tap.c index 4b2168e440..6d54c254d7 100644 --- a/drivers/net/tap/rte_eth_tap.c +++ b/drivers/net/tap/rte_eth_tap.c @@ -520,7 +520,7 @@ tap_tx_l3_cksum(char *packet, uint64_t ol_flags, unsigned int l2_len, } } -static inline void +static inline int tap_write_mbufs(struct tx_queue *txq, uint16_t num_mbufs, struct rte_mbuf **pmbufs, uint16_t *num_packets, unsigned long *num_tx_bytes) @@ -587,7 +587,7 @@ tap_write_mbufs(struct tx_queue *txq, uint16_t num_mbufs, seg_len = rte_pktmbuf_data_len(mbuf); l234_hlen = mbuf->l2_len + mbuf->l3_len + mbuf->l4_len; if (seg_len < l234_hlen) - break; + return -1; /* To change checksums, work on a * copy of l2, l3 * headers + l4 pseudo header @@ -633,10 +633,12 @@ tap_write_mbufs(struct tx_queue *txq, uint16_t num_mbufs, /* copy the tx frame data */ n = writev(process_private->txq_fds[txq->queue_id], iovecs, j); if (n <= 0) - break; + return -1; + (*num_packets)++; (*num_tx_bytes) += rte_pktmbuf_pkt_len(mbuf); } + return 0; } /* Callback to handle sending packets from the tap interface @@ -662,8 +664,8 @@ pmd_tx_burst(void *queue, struct rte_mbuf **bufs, uint16_t nb_pkts) uint16_t num_mbufs = 0; uint16_t tso_segsz = 0; int ret; + int num_tso_mbufs; uint16_t hdrs_len; - int j; uint64_t tso; tso = mbuf_in->ol_flags & PKT_TX_TCP_SEG; @@ -683,43 +685,51 @@ pmd_tx_burst(void *queue, struct rte_mbuf **bufs, uint16_t nb_pkts) break; } gso_ctx->gso_size = tso_segsz; - ret = rte_gso_segment(mbuf_in, /* packet to segment */ + /* 'mbuf_in' packet to segment */ + num_tso_mbufs = rte_gso_segment(mbuf_in, gso_ctx, /* gso control block */ (struct rte_mbuf **)&gso_mbufs, /* out mbufs */ RTE_DIM(gso_mbufs)); /* max tso mbufs */ /* ret contains the number of new created mbufs */ - if (ret < 0) + if (num_tso_mbufs < 0) break; mbuf = gso_mbufs; - num_mbufs = ret; + num_mbufs = num_tso_mbufs; } else { /* stats.errs will be incremented */ if (rte_pktmbuf_pkt_len(mbuf_in) > max_size) break; /* ret 0 indicates no new mbufs were created */ - ret = 0; + num_tso_mbufs = 0; mbuf = &mbuf_in; num_mbufs = 1; } - tap_write_mbufs(txq, num_mbufs, mbuf, + ret = tap_write_mbufs(txq, num_mbufs, mbuf, &num_packets, &num_tx_bytes); + if (ret == -1) { + txq->stats.errs++; + /* free tso mbufs */ + if (num_tso_mbufs > 0) + rte_pktmbuf_free_bulk(mbuf, num_tso_mbufs); + break; + } num_tx++; /* free original mbuf */ rte_pktmbuf_free(mbuf_in); /* free tso mbufs */ - for (j = 0; j < ret; j++) - rte_pktmbuf_free(mbuf[j]); + if (num_tso_mbufs > 0) + rte_pktmbuf_free_bulk(mbuf, num_tso_mbufs); } txq->stats.opackets += num_packets; txq->stats.errs += nb_pkts - num_tx; txq->stats.obytes += num_tx_bytes; - return num_packets; + return num_tx; } static const char * -- 2.20.1 --- Diff of the applied patch vs upstream commit (please double-check if non-empty: --- --- - 2020-05-19 14:04:48.269728872 +0100 +++ 0093-net-tap-fix-mbuf-double-free-when-writev-fails.patch 2020-05-19 14:04:44.304649968 +0100 @@ -1,15 +1,16 @@ -From 24cb500c17c6914fce4c8df278b06966d70b897d Mon Sep 17 00:00:00 2001 +From 908866e6fc81fb9cfd6e36518be56b0f6fe3f0e3 Mon Sep 17 00:00:00 2001 From: Yunjian Wang Date: Thu, 16 Apr 2020 11:04:07 +0800 Subject: [PATCH] net/tap: fix mbuf double free when writev fails +[ upstream commit 24cb500c17c6914fce4c8df278b06966d70b897d ] + When the tap_write_mbufs() function return with break, mbuf was freed without increasing num_packets, which could cause applications to free the mbuf again. And the pmd_tx_burst() function should returns the number of original packets it actually sent excluding tso mbufs. Fixes: 9396ad334672 ("net/tap: fix reported number of Tx packets") -Cc: stable@dpdk.org Signed-off-by: Yunjian Wang Reviewed-by: Ferruh Yigit