From: Nelio Laranjeiro <nelio.laranjeiro@6wind.com>
To: stable@dpdk.org, Yuanhan Liu <yuanhan.liu@linux.intel.com>
Cc: Sagi Grimberg <sagi@grimberg.me>,
Adrien Mazarguil <adrien.mazarguil@6wind.com>
Subject: [dpdk-stable] [PATCH v2 02/12] net/mlx5: fix possible NULL dereference in Rx path
Date: Wed, 9 Nov 2016 10:57:41 +0100 [thread overview]
Message-ID: <c5188cab1764bbe43132455e581f2fd2269c92aa.1478683594.git.nelio.laranjeiro@6wind.com> (raw)
In-Reply-To: <cover.1478683594.git.nelio.laranjeiro@6wind.com>
In-Reply-To: <cover.1478683594.git.nelio.laranjeiro@6wind.com>
From: Sagi Grimberg <sagi@grimberg.me>
[ upstream commit 15a756b63734c1d95e3f8d922e67d11fb32b025b ]
The user is allowed to call ->rx_pkt_burst() even without free
mbufs in the pool. In this scenario we'll fail allocating a rep mbuf
on the first iteration (where pkt is still NULL). This would cause us
to deref a NULL pkt (reset refcount and free).
Fix this by checking the pkt before freeing it.
Fixes: a1bdb71a32da ("net/mlx5: fix crash in Rx")
Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
Acked-by: Adrien Mazarguil <adrien.mazarguil@6wind.com>
---
drivers/net/mlx5/mlx5_rxtx.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/drivers/net/mlx5/mlx5_rxtx.c b/drivers/net/mlx5/mlx5_rxtx.c
index cc62e78..59e8183 100644
--- a/drivers/net/mlx5/mlx5_rxtx.c
+++ b/drivers/net/mlx5/mlx5_rxtx.c
@@ -1572,6 +1572,14 @@ mlx5_rx_burst(void *dpdk_rxq, struct rte_mbuf **pkts, uint16_t pkts_n)
rte_prefetch0(wqe);
rep = rte_mbuf_raw_alloc(rxq->mp);
if (unlikely(rep == NULL)) {
+ ++rxq->stats.rx_nombuf;
+ if (!pkt) {
+ /*
+ * no buffers before we even started,
+ * bail out silently.
+ */
+ break;
+ }
while (pkt != seg) {
assert(pkt != (*rxq->elts)[idx]);
seg = NEXT(pkt);
@@ -1579,7 +1587,6 @@ mlx5_rx_burst(void *dpdk_rxq, struct rte_mbuf **pkts, uint16_t pkts_n)
__rte_mbuf_raw_free(pkt);
pkt = seg;
}
- ++rxq->stats.rx_nombuf;
break;
}
if (!pkt) {
--
2.1.4
next prev parent reply other threads:[~2016-11-09 9:58 UTC|newest]
Thread overview: 31+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-11-08 10:36 [dpdk-stable] [PATCH 00/14] Patches for 16.07.2 stable branch Nelio Laranjeiro
2016-11-08 10:36 ` [dpdk-stable] [PATCH 01/14] net/mlx5: support Mellanox OFED 3.4 Nelio Laranjeiro
2016-11-08 10:36 ` [dpdk-stable] [PATCH 02/14] net/mlx5: fix possible NULL dereference in Rx path Nelio Laranjeiro
2016-11-08 10:36 ` [dpdk-stable] [PATCH 03/14] net/mlx5: fix inconsistent return value in flow director Nelio Laranjeiro
2016-11-08 10:36 ` [dpdk-stable] [PATCH 04/14] net/mlx5: fix Rx VLAN offload capability report Nelio Laranjeiro
2016-11-08 10:36 ` [dpdk-stable] [PATCH 05/14] net/mlx5: fix removing VLAN filter Nelio Laranjeiro
2016-11-08 10:36 ` [dpdk-stable] [PATCH 06/14] net/mlx5: refactor allocation of flow director queues Nelio Laranjeiro
2016-11-08 10:36 ` [dpdk-stable] [PATCH 07/14] net/mlx5: fix flow director drop mode Nelio Laranjeiro
2016-11-08 10:36 ` [dpdk-stable] [PATCH 08/14] net/mlx5: re-factorize functions Nelio Laranjeiro
2016-11-08 10:36 ` [dpdk-stable] [PATCH 09/14] net/mlx5: fix inline logic Nelio Laranjeiro
2016-11-08 10:36 ` [dpdk-stable] [PATCH 10/14] net/mlx5: fix Rx function selection Nelio Laranjeiro
2016-11-08 10:36 ` [dpdk-stable] [PATCH 11/14] net/mlx5: fix link status report Nelio Laranjeiro
2016-11-08 10:36 ` [dpdk-stable] [PATCH 12/14] net/mlx5: fix initialization in secondary process Nelio Laranjeiro
2016-11-08 10:36 ` [dpdk-stable] [PATCH 13/14] net/mlx5: fix link speed capability information Nelio Laranjeiro
2016-11-08 10:36 ` [dpdk-stable] [PATCH 14/14] net/mlx5: fix support for newer link speeds Nelio Laranjeiro
2016-11-09 5:39 ` [dpdk-stable] [PATCH 00/14] Patches for 16.07.2 stable branch Yuanhan Liu
2016-11-09 9:38 ` Nélio Laranjeiro
2016-11-09 9:57 ` [dpdk-stable] [PATCH v2 00/12] " Nelio Laranjeiro
2016-11-09 11:01 ` Yuanhan Liu
2016-11-09 9:57 ` [dpdk-stable] [PATCH v2 01/12] net/mlx5: support Mellanox OFED 3.4 Nelio Laranjeiro
2016-11-09 9:57 ` Nelio Laranjeiro [this message]
2016-11-09 9:57 ` [dpdk-stable] [PATCH v2 03/12] net/mlx5: fix inconsistent return value in flow director Nelio Laranjeiro
2016-11-09 9:57 ` [dpdk-stable] [PATCH v2 04/12] net/mlx5: fix Rx VLAN offload capability report Nelio Laranjeiro
2016-11-09 9:57 ` [dpdk-stable] [PATCH v2 05/12] net/mlx5: fix removing VLAN filter Nelio Laranjeiro
2016-11-09 9:57 ` [dpdk-stable] [PATCH v2 06/12] net/mlx5: refactor allocation of flow director queues Nelio Laranjeiro
2016-11-09 9:57 ` [dpdk-stable] [PATCH v2 07/12] net/mlx5: fix flow director drop mode Nelio Laranjeiro
2016-11-09 9:57 ` [dpdk-stable] [PATCH v2 08/12] net/mlx5: re-factorize functions Nelio Laranjeiro
2016-11-09 9:57 ` [dpdk-stable] [PATCH v2 09/12] net/mlx5: fix inline logic Nelio Laranjeiro
2016-11-09 9:57 ` [dpdk-stable] [PATCH v2 10/12] net/mlx5: fix initialization in secondary process Nelio Laranjeiro
2016-11-09 9:57 ` [dpdk-stable] [PATCH v2 11/12] net/mlx5: fix link speed capability information Nelio Laranjeiro
2016-11-09 9:57 ` [dpdk-stable] [PATCH v2 12/12] net/mlx5: fix support for newer link speeds Nelio Laranjeiro
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=c5188cab1764bbe43132455e581f2fd2269c92aa.1478683594.git.nelio.laranjeiro@6wind.com \
--to=nelio.laranjeiro@6wind.com \
--cc=adrien.mazarguil@6wind.com \
--cc=sagi@grimberg.me \
--cc=stable@dpdk.org \
--cc=yuanhan.liu@linux.intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).