From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id BCFA443D04 for ; Wed, 20 Mar 2024 15:52:07 +0100 (CET) Received: from mails.dpdk.org (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 9B988402B9; Wed, 20 Mar 2024 15:52:07 +0100 (CET) Received: from smtp-fw-2101.amazon.com (smtp-fw-2101.amazon.com [72.21.196.25]) by mails.dpdk.org (Postfix) with ESMTP id 0D0C24029F for ; Wed, 20 Mar 2024 15:52:05 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.com; i=@amazon.com; q=dns/txt; s=amazon201209; t=1710946326; x=1742482326; h=from:to:cc:subject:date:message-id:mime-version; bh=AQupAN6y9L6gsTq9xXGLO1d5IupwS8r2PEbLNMYwcIU=; b=HYA24wNx/t6CxuDLKmX77QqFz+U8o78bNJI/26DKCg94AGN6kCPbIDBY XjkIXAwnxDmmAdn0Rw8+40YZPbgJOxuPlvShSUQgDEFjonUdmHyxbXf/g 8kF6XhT5OzIKhsTyITkBCh8PuUza3ioiLxnoT5O74XtpHejaoO5ns0C7v A=; X-IronPort-AV: E=Sophos;i="6.07,140,1708387200"; d="scan'208";a="389138977" Received: from iad12-co-svc-p1-lb1-vlan3.amazon.com (HELO smtpout.prod.us-west-2.prod.farcaster.email.amazon.dev) ([10.43.8.6]) by smtp-border-fw-2101.iad2.amazon.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 20 Mar 2024 14:52:04 +0000 Received: from EX19MTAEUA001.ant.amazon.com [10.0.43.254:42467] by smtpin.naws.eu-west-1.prod.farcaster.email.amazon.dev [10.0.6.197:2525] with esmtp (Farcaster) id 6a6f62fa-2299-4c1e-937d-307da9572179; Wed, 20 Mar 2024 14:52:02 +0000 (UTC) X-Farcaster-Flow-ID: 6a6f62fa-2299-4c1e-937d-307da9572179 Received: from EX19D007EUA001.ant.amazon.com (10.252.50.133) by EX19MTAEUA001.ant.amazon.com (10.252.50.223) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1258.28; Wed, 20 Mar 2024 14:52:02 +0000 Received: from EX19MTAUWA001.ant.amazon.com (10.250.64.204) by EX19D007EUA001.ant.amazon.com (10.252.50.133) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1258.28; Wed, 20 Mar 2024 14:52:01 +0000 Received: from HFA15-CG15235BS.amazon.com (10.1.213.17) by mail-relay.amazon.com (10.250.64.204) with Microsoft SMTP Server id 15.2.1258.28 via Frontend Transport; Wed, 20 Mar 2024 14:52:00 +0000 From: To: CC: Subject: [PATCH] net/ena: fix mbuf double free in fast free mode Date: Wed, 20 Mar 2024 16:51:57 +0200 Message-ID: <20240320145157.488-1-shaibran@amazon.com> X-Mailer: git-send-email 2.17.1 MIME-Version: 1.0 Content-Type: text/plain X-BeenThere: stable@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: patches for DPDK stable branches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: stable-bounces@dpdk.org From: Shai Brandes Fixed an issue of double free of mbufs which is exposed in mbuf fast free mode when handling multi-mbuf packets. The faulty patch mishandled free of non-head mbufs as it iterated over linked mbufs and collected them into an array, which was then passed to rte_pktmbuf_free_bulk. However, rte_pktmbuf_free_bulk already performs an internal iteration over mbufs that are linked together which led to double free. Fixes: 89b081e154c5 ("net/ena: fix fast mbuf free") Cc: stable@dpdk.org Signed-off-by: Shai Brandes --- drivers/net/ena/ena_ethdev.c | 39 +++++++++++------------------------- 1 file changed, 12 insertions(+), 27 deletions(-) diff --git a/drivers/net/ena/ena_ethdev.c b/drivers/net/ena/ena_ethdev.c index 7b697c150a..66fc287faf 100644 --- a/drivers/net/ena/ena_ethdev.c +++ b/drivers/net/ena/ena_ethdev.c @@ -48,10 +48,10 @@ #define MAX_WIDE_LLQ_DEPTH_UNSUPPORTED 0 /* - * We should try to keep ENA_CLEANUP_BUF_SIZE lower than + * We should try to keep ENA_CLEANUP_BUF_THRESH lower than * RTE_MEMPOOL_CACHE_MAX_SIZE, so we can fit this in mempool local cache. */ -#define ENA_CLEANUP_BUF_SIZE 256 +#define ENA_CLEANUP_BUF_THRESH 256 #define ENA_PTYPE_HAS_HASH (RTE_PTYPE_L4_TCP | RTE_PTYPE_L4_UDP) @@ -3180,32 +3180,12 @@ static int ena_xmit_mbuf(struct ena_ring *tx_ring, struct rte_mbuf *mbuf) return 0; } -static __rte_always_inline size_t -ena_tx_cleanup_mbuf_fast(struct rte_mbuf **mbufs_to_clean, - struct rte_mbuf *mbuf, - size_t mbuf_cnt, - size_t buf_size) -{ - struct rte_mbuf *m_next; - - while (mbuf != NULL) { - m_next = mbuf->next; - mbufs_to_clean[mbuf_cnt++] = mbuf; - if (mbuf_cnt == buf_size) { - rte_pktmbuf_free_bulk(mbufs_to_clean, mbuf_cnt); - mbuf_cnt = 0; - } - mbuf = m_next; - } - - return mbuf_cnt; -} - static int ena_tx_cleanup(void *txp, uint32_t free_pkt_cnt) { - struct rte_mbuf *mbufs_to_clean[ENA_CLEANUP_BUF_SIZE]; + struct rte_mbuf *pkts_to_clean[ENA_CLEANUP_BUF_THRESH]; struct ena_ring *tx_ring = (struct ena_ring *)txp; size_t mbuf_cnt = 0; + size_t pkt_cnt = 0; unsigned int total_tx_descs = 0; unsigned int total_tx_pkts = 0; uint16_t cleanup_budget; @@ -3236,8 +3216,13 @@ static int ena_tx_cleanup(void *txp, uint32_t free_pkt_cnt) mbuf = tx_info->mbuf; if (fast_free) { - mbuf_cnt = ena_tx_cleanup_mbuf_fast(mbufs_to_clean, mbuf, mbuf_cnt, - ENA_CLEANUP_BUF_SIZE); + pkts_to_clean[pkt_cnt++] = mbuf; + mbuf_cnt += mbuf->nb_segs; + if (mbuf_cnt >= ENA_CLEANUP_BUF_THRESH) { + rte_pktmbuf_free_bulk(pkts_to_clean, pkt_cnt); + mbuf_cnt = 0; + pkt_cnt = 0; + } } else { rte_pktmbuf_free(mbuf); } @@ -3260,7 +3245,7 @@ static int ena_tx_cleanup(void *txp, uint32_t free_pkt_cnt) } if (mbuf_cnt != 0) - rte_pktmbuf_free_bulk(mbufs_to_clean, mbuf_cnt); + rte_pktmbuf_free_bulk(pkts_to_clean, pkt_cnt); /* Notify completion handler that full cleanup was performed */ if (free_pkt_cnt == 0 || total_tx_pkts < cleanup_budget) -- 2.17.1