From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 50B1CA0547 for ; Wed, 29 Sep 2021 23:37:38 +0200 (CEST) Received: from [217.70.189.124] (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 37463410EF; Wed, 29 Sep 2021 23:37:38 +0200 (CEST) Received: from mail-wm1-f50.google.com (mail-wm1-f50.google.com [209.85.128.50]) by mails.dpdk.org (Postfix) with ESMTP id 3A2FF410EA for ; Wed, 29 Sep 2021 23:37:36 +0200 (CEST) Received: by mail-wm1-f50.google.com with SMTP id t16-20020a1c7710000000b003049690d882so6449996wmi.5 for ; Wed, 29 Sep 2021 14:37:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=6wind.com; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=qW/WsSuBGRyBRpXb9qALTVvpOEfoYhrkG/vNCzDev2s=; b=ELxh6rhfD8YMsOfNYzrquX7ZTAfNbot1QMinfwbIOWU6+1sRr+BfCTkINWg5h/Ni6B xQRpQ6nI6Dtcps/w+vw0SjhsbQ+dI1UZ+AAtmWu8CtUN3NtTJGflUwqbM2DFX4rnK9C2 f/bGhg0S7IWzBVo0hEha7cg13Mws1HV7NxGeoAuUtDBWUL2anuhwZhrWFzdEiUUUdQ3i p0VadIwz7/i+zJk1npZsPDOcW6UIGZ+6HUev+pUUTdHGYSldZe78fGTSbZPrzu9/ZvSs TDX1PtT8vzMtrhcq8Zxc7Euw7Zo1DS7M2E1iRDCXO6RSDGaRiyAbdpD65offzG6Fmc9w k5XQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=qW/WsSuBGRyBRpXb9qALTVvpOEfoYhrkG/vNCzDev2s=; b=wombIXpxr5sEJNRI1MmehkD0Kzl6Tn5aL+FOGfztuPeLDPjsUHgThcmTuFPt5tX2iy IMvjMOvREiQiPFBDaXuk1CN4JjOeLaqcRwuwocmBxMlE9GfL+GIoUX2y1h+zaGjesML7 SkvnpN7k8SMsLEcwNrLDRKFXVowXlbltcWaeXd9/fv2vopUoPNtE8UmRZR8ruwX3aP2l VX67qU/AfBVR89D3CHpeAhYTx8npS3PN9238KGotoykI5pJs4oHLmqJqmnNRqNZMszCJ C4TzZdyrUHx3hpDtKtxNYnVmUqCYJ4vIWmQnqvEB7zJQR74n//Qb4o/cfWA+uMTyQCUG qO5A== X-Gm-Message-State: AOAM5323EgvAeUORowvBQ8c9MKspEnB74fYD7LtAemvvkb4RSxBTP4p6 mtY1EBfMHrhpX7HrvHcv2mV/1A== X-Google-Smtp-Source: ABdhPJypEUKE5cW+D9bU84LeVDgKPzOcHCvt4KZTHJxykgAQo1aOrVT2mIqD2KphjXIANqzJsIkPug== X-Received: by 2002:a05:600c:c4:: with SMTP id u4mr2148219wmm.194.1632951455699; Wed, 29 Sep 2021 14:37:35 -0700 (PDT) Received: from gojira.dev.6wind.com (host.78.145.23.62.rev.coltfrance.com. [62.23.145.78]) by smtp.gmail.com with ESMTPSA id c8sm1067246wru.30.2021.09.29.14.37.34 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 29 Sep 2021 14:37:35 -0700 (PDT) From: Olivier Matz To: dev@dpdk.org Cc: ajit.khaparde@broadcom.com, ajitkhaparde@gmail.com, alialnu@nvidia.com, andrew.rybchenko@oktetlabs.ru, konstantin.ananyev@intel.com, mb@smartsharesystems.com, stable@dpdk.org, viacheslavo@nvidia.com Date: Wed, 29 Sep 2021 23:37:07 +0200 Message-Id: <20210929213707.17727-1-olivier.matz@6wind.com> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20210113132734.1636-1-olivier.matz@6wind.com> References: <20210113132734.1636-1-olivier.matz@6wind.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Subject: [dpdk-stable] [PATCH v5] mbuf: fix reset on mbuf free X-BeenThere: stable@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: patches for DPDK stable branches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: stable-bounces@dpdk.org Sender: "stable" m->nb_seg must be reset on mbuf free whatever the value of m->next, because it can happen that m->nb_seg is != 1. For instance in this case: m1 = rte_pktmbuf_alloc(mp); rte_pktmbuf_append(m1, 500); m2 = rte_pktmbuf_alloc(mp); rte_pktmbuf_append(m2, 500); rte_pktmbuf_chain(m1, m2); m0 = rte_pktmbuf_alloc(mp); rte_pktmbuf_append(m0, 500); rte_pktmbuf_chain(m0, m1); As rte_pktmbuf_chain() does not reset nb_seg in the initial m1 segment (this is not required), after this code the mbuf chain have 3 segments: - m0: next=m1, nb_seg=3 - m1: next=m2, nb_seg=2 - m2: next=NULL, nb_seg=1 Then split this chain between m1 and m2, it would result in 2 packets: - first packet - m0: next=m1, nb_seg=2 - m1: next=NULL, nb_seg=2 - second packet - m2: next=NULL, nb_seg=1 Freeing the first packet will not restore nb_seg=1 in the second segment. This is an issue because it is expected that mbufs stored in pool have their nb_seg field set to 1. Fixes: 8f094a9ac5d7 ("mbuf: set mbuf fields while in pool") Cc: stable@dpdk.org Signed-off-by: Olivier Matz Acked-by: Morten Brørup Acked-by: Ajit Khaparde Acked-by: Konstantin Ananyev --- app/test/test_mbuf.c | 69 ++++++++++++++++++++++++++++++++++++++++ lib/mbuf/rte_mbuf.c | 4 +-- lib/mbuf/rte_mbuf.h | 8 ++--- lib/mbuf/rte_mbuf_core.h | 13 ++++++-- 4 files changed, 86 insertions(+), 8 deletions(-) diff --git a/app/test/test_mbuf.c b/app/test/test_mbuf.c index 9a248dfaea..a4e32e933a 100644 --- a/app/test/test_mbuf.c +++ b/app/test/test_mbuf.c @@ -2684,6 +2684,70 @@ test_mbuf_dyn(struct rte_mempool *pktmbuf_pool) return -1; } +/* check that m->nb_segs and m->next are reset on mbuf free */ +static int +test_nb_segs_and_next_reset(void) +{ + struct rte_mbuf *m0 = NULL, *m1 = NULL, *m2 = NULL; + struct rte_mempool *pool = NULL; + + pool = rte_pktmbuf_pool_create("test_mbuf_reset", + 3, 0, 0, MBUF_DATA_SIZE, SOCKET_ID_ANY); + if (pool == NULL) + GOTO_FAIL("Failed to create mbuf pool"); + + /* alloc mbufs */ + m0 = rte_pktmbuf_alloc(pool); + m1 = rte_pktmbuf_alloc(pool); + m2 = rte_pktmbuf_alloc(pool); + if (m0 == NULL || m1 == NULL || m2 == NULL) + GOTO_FAIL("Failed to allocate mbuf"); + + /* append data in all of them */ + if (rte_pktmbuf_append(m0, 500) == NULL || + rte_pktmbuf_append(m1, 500) == NULL || + rte_pktmbuf_append(m2, 500) == NULL) + GOTO_FAIL("Failed to append data in mbuf"); + + /* chain them in one mbuf m0 */ + rte_pktmbuf_chain(m1, m2); + rte_pktmbuf_chain(m0, m1); + if (m0->nb_segs != 3 || m0->next != m1 || m1->next != m2 || + m2->next != NULL) { + m1 = m2 = NULL; + GOTO_FAIL("Failed to chain mbufs"); + } + + /* split m0 chain in two, between m1 and m2 */ + m0->nb_segs = 2; + m1->next = NULL; + m2->nb_segs = 1; + + /* free the 2 mbuf chains m0 and m2 */ + rte_pktmbuf_free(m0); + rte_pktmbuf_free(m2); + + /* realloc the 3 mbufs */ + m0 = rte_mbuf_raw_alloc(pool); + m1 = rte_mbuf_raw_alloc(pool); + m2 = rte_mbuf_raw_alloc(pool); + if (m0 == NULL || m1 == NULL || m2 == NULL) + GOTO_FAIL("Failed to reallocate mbuf"); + + /* ensure that m->next and m->nb_segs are reset allocated mbufs */ + if (m0->nb_segs != 1 || m0->next != NULL || + m1->nb_segs != 1 || m1->next != NULL || + m2->nb_segs != 1 || m2->next != NULL) + GOTO_FAIL("nb_segs or next was not reset properly"); + + return 0; + +fail: + if (pool != NULL) + rte_mempool_free(pool); + return -1; +} + static int test_mbuf(void) { @@ -2874,6 +2938,11 @@ test_mbuf(void) goto err; } + /* test reset of m->nb_segs and m->next on mbuf free */ + if (test_nb_segs_and_next_reset() < 0) { + printf("test_nb_segs_and_next_reset() failed\n"); + goto err; + } ret = 0; err: diff --git a/lib/mbuf/rte_mbuf.c b/lib/mbuf/rte_mbuf.c index f7e3c1a187..f145cd800a 100644 --- a/lib/mbuf/rte_mbuf.c +++ b/lib/mbuf/rte_mbuf.c @@ -134,10 +134,10 @@ rte_pktmbuf_free_pinned_extmem(void *addr, void *opaque) rte_mbuf_ext_refcnt_set(m->shinfo, 1); m->ol_flags = EXT_ATTACHED_MBUF; - if (m->next != NULL) { + if (m->next != NULL) m->next = NULL; + if (m->nb_segs != 1) m->nb_segs = 1; - } rte_mbuf_raw_free(m); } diff --git a/lib/mbuf/rte_mbuf.h b/lib/mbuf/rte_mbuf.h index a555f216ae..dded3dd70c 100644 --- a/lib/mbuf/rte_mbuf.h +++ b/lib/mbuf/rte_mbuf.h @@ -1346,10 +1346,10 @@ rte_pktmbuf_prefree_seg(struct rte_mbuf *m) return NULL; } - if (m->next != NULL) { + if (m->next != NULL) m->next = NULL; + if (m->nb_segs != 1) m->nb_segs = 1; - } return m; @@ -1363,10 +1363,10 @@ rte_pktmbuf_prefree_seg(struct rte_mbuf *m) return NULL; } - if (m->next != NULL) { + if (m->next != NULL) m->next = NULL; + if (m->nb_segs != 1) m->nb_segs = 1; - } rte_mbuf_refcnt_set(m, 1); return m; diff --git a/lib/mbuf/rte_mbuf_core.h b/lib/mbuf/rte_mbuf_core.h index 9d8e3ddc86..9ef807daaa 100644 --- a/lib/mbuf/rte_mbuf_core.h +++ b/lib/mbuf/rte_mbuf_core.h @@ -508,7 +508,12 @@ struct rte_mbuf { * or non-atomic) is controlled by the RTE_MBUF_REFCNT_ATOMIC flag. */ uint16_t refcnt; - uint16_t nb_segs; /**< Number of segments. */ + + /** + * Number of segments. Only valid for the first segment of an mbuf + * chain. + */ + uint16_t nb_segs; /** Input port (16 bits to support more than 256 virtual ports). * The event eth Tx adapter uses this field to specify the output port. @@ -604,7 +609,11 @@ struct rte_mbuf { /* second cache line - fields only used in slow path or on TX */ RTE_MARKER cacheline1 __rte_cache_min_aligned; - struct rte_mbuf *next; /**< Next segment of scattered packet. */ + /** + * Next segment of scattered packet. Must be NULL in the last segment or + * in case of non-segmented packet. + */ + struct rte_mbuf *next; /* fields to support TX offloads */ RTE_STD_C11 -- 2.30.2