From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from dpdk.org (dpdk.org [92.243.14.124]) by inbox.dpdk.org (Postfix) with ESMTP id 376E6A04DD for ; Wed, 4 Nov 2020 18:00:19 +0100 (CET) Received: from [92.243.14.124] (localhost [127.0.0.1]) by dpdk.org (Postfix) with ESMTP id E9A382C7A; Wed, 4 Nov 2020 18:00:17 +0100 (CET) Received: from proxy.6wind.com (host.76.145.23.62.rev.coltfrance.com [62.23.145.76]) by dpdk.org (Postfix) with ESMTP id 1CE122BD3; Wed, 4 Nov 2020 18:00:13 +0100 (CET) Received: from glumotte.dev.6wind.com. (unknown [10.16.0.195]) by proxy.6wind.com (Postfix) with ESMTP id D7992483C5A; Wed, 4 Nov 2020 18:00:12 +0100 (CET) From: Olivier Matz To: dev@dpdk.org Cc: konstantin.ananyev@intel.com, stable@dpdk.org Date: Wed, 4 Nov 2020 18:00:07 +0100 Message-Id: <20201104170007.8026-1-olivier.matz@6wind.com> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Subject: [dpdk-stable] [PATCH] mbuf: fix reset on mbuf free X-BeenThere: stable@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: patches for DPDK stable branches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: stable-bounces@dpdk.org Sender: "stable" m->nb_seg must be reset on mbuf free whatever the value of m->next, because it can happen that m->nb_seg is != 1. For instance in this case: m1 = rte_pktmbuf_alloc(mp); rte_pktmbuf_append(m1, 500); m2 = rte_pktmbuf_alloc(mp); rte_pktmbuf_append(m2, 500); rte_pktmbuf_chain(m1, m2); m0 = rte_pktmbuf_alloc(mp); rte_pktmbuf_append(m0, 500); rte_pktmbuf_chain(m0, m1); As rte_pktmbuf_chain() does not reset nb_seg in the initial m1 segment (this is not required), after this code the mbuf chain have 3 segments: - m0: next=m1, nb_seg=3 - m1: next=m2, nb_seg=2 - m2: next=NULL, nb_seg=1 Freeing this mbuf chain will not restore nb_seg=1 in the second segment. This is expected that mbufs stored in pool have their nb_seg field set to 1. Fixes: 8f094a9ac5d7 ("mbuf: set mbuf fields while in pool") Cc: stable@dpdk.org Signed-off-by: Olivier Matz --- lib/librte_mbuf/rte_mbuf.c | 6 ++---- lib/librte_mbuf/rte_mbuf.h | 12 ++++-------- 2 files changed, 6 insertions(+), 12 deletions(-) diff --git a/lib/librte_mbuf/rte_mbuf.c b/lib/librte_mbuf/rte_mbuf.c index 8a456e5e64..e632071c23 100644 --- a/lib/librte_mbuf/rte_mbuf.c +++ b/lib/librte_mbuf/rte_mbuf.c @@ -129,10 +129,8 @@ rte_pktmbuf_free_pinned_extmem(void *addr, void *opaque) rte_mbuf_ext_refcnt_set(m->shinfo, 1); m->ol_flags = EXT_ATTACHED_MBUF; - if (m->next != NULL) { - m->next = NULL; - m->nb_segs = 1; - } + m->next = NULL; + m->nb_segs = 1; rte_mbuf_raw_free(m); } diff --git a/lib/librte_mbuf/rte_mbuf.h b/lib/librte_mbuf/rte_mbuf.h index a1414ed7cd..ef5800c8ef 100644 --- a/lib/librte_mbuf/rte_mbuf.h +++ b/lib/librte_mbuf/rte_mbuf.h @@ -1329,10 +1329,8 @@ rte_pktmbuf_prefree_seg(struct rte_mbuf *m) return NULL; } - if (m->next != NULL) { - m->next = NULL; - m->nb_segs = 1; - } + m->next = NULL; + m->nb_segs = 1; return m; @@ -1346,10 +1344,8 @@ rte_pktmbuf_prefree_seg(struct rte_mbuf *m) return NULL; } - if (m->next != NULL) { - m->next = NULL; - m->nb_segs = 1; - } + m->next = NULL; + m->nb_segs = 1; rte_mbuf_refcnt_set(m, 1); return m; -- 2.25.1