From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 0CDC443D47 for ; Mon, 25 Mar 2024 13:08:33 +0100 (CET) Received: from mails.dpdk.org (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id E5163406BA; Mon, 25 Mar 2024 13:08:32 +0100 (CET) Received: from mail-wr1-f43.google.com (mail-wr1-f43.google.com [209.85.221.43]) by mails.dpdk.org (Postfix) with ESMTP id DD8924068A for ; Mon, 25 Mar 2024 13:08:29 +0100 (CET) Received: by mail-wr1-f43.google.com with SMTP id ffacd0b85a97d-33ed7ef0ae8so3017550f8f.0 for ; Mon, 25 Mar 2024 05:08:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1711368509; x=1711973309; darn=dpdk.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=z/R9lHqodJsc6dCppqL5HkLUUXG3lU2NLglgEdisdas=; b=Mf2Oj8NWW9iB3j8TT2H1DYQdz0LSyl1DNDn7pR1PhuzXhzPauiiuEBxTzEh5m23lq+ jY5iwpJpXRDkszGmeFf0gIkbSHRQKdWJgJR8Hu7CgDqcT3f82rEJHsYI6ctg+Gc+swRk Zg6lmP68auKT+XCq8I9VFLeRwe6hpFtaNhQWHYesIUO3ZX/Y3dJVOUj7PYgX92LhuqJu eTRPYChwSwSyLyegAQnxzeU5N6hoOkYiBbyqlklYdCM6KisTTA/DKDt4Yino0qN+BD55 7unxE6F1V8yis6EuVdZY2YbIJU6vqakP7mn1dwC6HxVJAuw4N+GjS3HUA8cd1HXq9+X/ dheQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1711368509; x=1711973309; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=z/R9lHqodJsc6dCppqL5HkLUUXG3lU2NLglgEdisdas=; b=HEec/XyC1pmMvRPvAblh7fkP6AhkEIU1Xp5whhSWZ6anSsnWvlXMeyxALQs+x+gGr7 M8ZiVNOj6lSWoS3kXWzOlWAGQ+eJDLVt52ibztKSy/D1arg2GDmTfV+uKigPuCkzB8YL ZXQneEHRkX7HXsWqGnWvy4muOPJbv2rXeMAIcbbOrJIRfe48fDSCv4S0sOpTxRwqeLPB 0kzJIIpBjFel9kQpqVnouDv4PwKGgFcha6cOiDaPdl0iP55HM6GsYq6HYqkZQnQB74Ui I6pxNmfICn2jZajoBT8SvK4cuNmqlelHaZCqZFjyQqbqyX2wepOVH1TxX14dNbis/fkX YVNg== X-Forwarded-Encrypted: i=1; AJvYcCWluJPIT3GarZe0auRKrbKzy3916LRU2ntiIygAn4Y3OQf7j/JQteTVZz/m9RDndYkBhbg/qxyWtmxVyNd1nOQ= X-Gm-Message-State: AOJu0YylfGunxOOPN9e8AfAYeZ3C0iGTrgR2VFWuqxwVtEDjNiTRdafH pP8wEZrt41rN7TGJCouwxrdkxOvpp6XTYp4peRSj4IDua3rDNiMi X-Google-Smtp-Source: AGHT+IH3r7hkVhWXbdbkm+pETs4SgGFr2G0VhSay+o6E9H6BTQ3DFPHB7AQYuF4P7qOFgsZUQxeqMg== X-Received: by 2002:a05:6000:1b92:b0:33d:2d07:b567 with SMTP id r18-20020a0560001b9200b0033d2d07b567mr4874584wru.24.1711368509237; Mon, 25 Mar 2024 05:08:29 -0700 (PDT) Received: from localhost ([137.220.120.171]) by smtp.gmail.com with ESMTPSA id q2-20020adfcd82000000b0033e7603987dsm9389200wrj.12.2024.03.25.05.08.28 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 25 Mar 2024 05:08:28 -0700 (PDT) From: luca.boccassi@gmail.com To: Shai Brandes Cc: Ferruh Yigit , dpdk stable Subject: patch 'net/ena: fix mbuf double free in fast free mode' has been queued to stable release 22.11.5 Date: Mon, 25 Mar 2024 12:08:17 +0000 Message-Id: <20240325120824.1104729-2-luca.boccassi@gmail.com> X-Mailer: git-send-email 2.39.2 In-Reply-To: <20240325120824.1104729-1-luca.boccassi@gmail.com> References: <20240318153919.3407921-28-luca.boccassi@gmail.com> <20240325120824.1104729-1-luca.boccassi@gmail.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-BeenThere: stable@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: patches for DPDK stable branches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: stable-bounces@dpdk.org Hi, FYI, your patch has been queued to stable release 22.11.5 Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet. It will be pushed if I get no objections before 03/27/24. So please shout if anyone has objections. Also note that after the patch there's a diff of the upstream commit vs the patch applied to the branch. This will indicate if there was any rebasing needed to apply to the stable branch. If there were code changes for rebasing (ie: not only metadata diffs), please double check that the rebase was correctly done. Queued patches are on a temporary branch at: https://github.com/bluca/dpdk-stable This queued commit can be viewed at: https://github.com/bluca/dpdk-stable/commit/3894e82ac5267b7d24e0a21791351115254be8ea Thanks. Luca Boccassi --- >From 3894e82ac5267b7d24e0a21791351115254be8ea Mon Sep 17 00:00:00 2001 From: Shai Brandes Date: Wed, 20 Mar 2024 16:52:32 +0200 Subject: [PATCH] net/ena: fix mbuf double free in fast free mode [ upstream commit 237407f0c3dff2d0a6bbeb5f35c8b32fe5c8afed ] Fixed an issue of double free of mbufs which is exposed in mbuf fast free mode when handling multi-mbuf packets. The faulty patch mishandled free of non-head mbufs as it iterated over linked mbufs and collected them into an array, which was then passed to rte_pktmbuf_free_bulk. However, rte_pktmbuf_free_bulk already performs an internal iteration over mbufs that are linked together which led to double free. Fixes: 89b081e154c5 ("net/ena: fix fast mbuf free") Signed-off-by: Shai Brandes Acked-by: Ferruh Yigit --- drivers/net/ena/ena_ethdev.c | 39 +++++++++++------------------------- 1 file changed, 12 insertions(+), 27 deletions(-) diff --git a/drivers/net/ena/ena_ethdev.c b/drivers/net/ena/ena_ethdev.c index 2c4e3505d0..29782a7fb6 100644 --- a/drivers/net/ena/ena_ethdev.c +++ b/drivers/net/ena/ena_ethdev.c @@ -37,10 +37,10 @@ #define ENA_MIN_RING_DESC 128 /* - * We should try to keep ENA_CLEANUP_BUF_SIZE lower than + * We should try to keep ENA_CLEANUP_BUF_THRESH lower than * RTE_MEMPOOL_CACHE_MAX_SIZE, so we can fit this in mempool local cache. */ -#define ENA_CLEANUP_BUF_SIZE 256 +#define ENA_CLEANUP_BUF_THRESH 256 #define ENA_PTYPE_HAS_HASH (RTE_PTYPE_L4_TCP | RTE_PTYPE_L4_UDP) @@ -3018,32 +3018,12 @@ static int ena_xmit_mbuf(struct ena_ring *tx_ring, struct rte_mbuf *mbuf) return 0; } -static __rte_always_inline size_t -ena_tx_cleanup_mbuf_fast(struct rte_mbuf **mbufs_to_clean, - struct rte_mbuf *mbuf, - size_t mbuf_cnt, - size_t buf_size) -{ - struct rte_mbuf *m_next; - - while (mbuf != NULL) { - m_next = mbuf->next; - mbufs_to_clean[mbuf_cnt++] = mbuf; - if (mbuf_cnt == buf_size) { - rte_pktmbuf_free_bulk(mbufs_to_clean, mbuf_cnt); - mbuf_cnt = 0; - } - mbuf = m_next; - } - - return mbuf_cnt; -} - static int ena_tx_cleanup(void *txp, uint32_t free_pkt_cnt) { - struct rte_mbuf *mbufs_to_clean[ENA_CLEANUP_BUF_SIZE]; + struct rte_mbuf *pkts_to_clean[ENA_CLEANUP_BUF_THRESH]; struct ena_ring *tx_ring = (struct ena_ring *)txp; size_t mbuf_cnt = 0; + size_t pkt_cnt = 0; unsigned int total_tx_descs = 0; unsigned int total_tx_pkts = 0; uint16_t cleanup_budget; @@ -3074,8 +3054,13 @@ static int ena_tx_cleanup(void *txp, uint32_t free_pkt_cnt) mbuf = tx_info->mbuf; if (fast_free) { - mbuf_cnt = ena_tx_cleanup_mbuf_fast(mbufs_to_clean, mbuf, mbuf_cnt, - ENA_CLEANUP_BUF_SIZE); + pkts_to_clean[pkt_cnt++] = mbuf; + mbuf_cnt += mbuf->nb_segs; + if (mbuf_cnt >= ENA_CLEANUP_BUF_THRESH) { + rte_pktmbuf_free_bulk(pkts_to_clean, pkt_cnt); + mbuf_cnt = 0; + pkt_cnt = 0; + } } else { rte_pktmbuf_free(mbuf); } @@ -3099,7 +3084,7 @@ static int ena_tx_cleanup(void *txp, uint32_t free_pkt_cnt) } if (mbuf_cnt != 0) - rte_pktmbuf_free_bulk(mbufs_to_clean, mbuf_cnt); + rte_pktmbuf_free_bulk(pkts_to_clean, pkt_cnt); /* Notify completion handler that full cleanup was performed */ if (free_pkt_cnt == 0 || total_tx_pkts < cleanup_budget) -- 2.39.2 --- Diff of the applied patch vs upstream commit (please double-check if non-empty: --- --- - 2024-03-25 11:28:37.366765928 +0000 +++ 0002-net-ena-fix-mbuf-double-free-in-fast-free-mode.patch 2024-03-25 11:28:37.176388004 +0000 @@ -1 +1 @@ -From 237407f0c3dff2d0a6bbeb5f35c8b32fe5c8afed Mon Sep 17 00:00:00 2001 +From 3894e82ac5267b7d24e0a21791351115254be8ea Mon Sep 17 00:00:00 2001 @@ -5,0 +6,2 @@ +[ upstream commit 237407f0c3dff2d0a6bbeb5f35c8b32fe5c8afed ] + @@ -16 +17,0 @@ -Cc: stable@dpdk.org @@ -25 +26 @@ -index 7b697c150a..66fc287faf 100644 +index 2c4e3505d0..29782a7fb6 100644 @@ -28,2 +29,2 @@ -@@ -48,10 +48,10 @@ - #define MAX_WIDE_LLQ_DEPTH_UNSUPPORTED 0 +@@ -37,10 +37,10 @@ + #define ENA_MIN_RING_DESC 128 @@ -41 +42 @@ -@@ -3180,32 +3180,12 @@ static int ena_xmit_mbuf(struct ena_ring *tx_ring, struct rte_mbuf *mbuf) +@@ -3018,32 +3018,12 @@ static int ena_xmit_mbuf(struct ena_ring *tx_ring, struct rte_mbuf *mbuf) @@ -76 +77 @@ -@@ -3236,8 +3216,13 @@ static int ena_tx_cleanup(void *txp, uint32_t free_pkt_cnt) +@@ -3074,8 +3054,13 @@ static int ena_tx_cleanup(void *txp, uint32_t free_pkt_cnt) @@ -92 +93 @@ -@@ -3260,7 +3245,7 @@ static int ena_tx_cleanup(void *txp, uint32_t free_pkt_cnt) +@@ -3099,7 +3084,7 @@ static int ena_tx_cleanup(void *txp, uint32_t free_pkt_cnt)