From mboxrd@z Thu Jan 1 00:00:00 1970
Return-Path: <dev-bounces@dpdk.org>
Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124])
by inbox.dpdk.org (Postfix) with ESMTP id D971EA0032;
Wed, 29 Sep 2021 23:37:37 +0200 (CEST)
Received: from [217.70.189.124] (localhost [127.0.0.1])
by mails.dpdk.org (Postfix) with ESMTP id 5B963410EA;
Wed, 29 Sep 2021 23:37:37 +0200 (CEST)
Received: from mail-wm1-f47.google.com (mail-wm1-f47.google.com
[209.85.128.47]) by mails.dpdk.org (Postfix) with ESMTP id 1723C410E5
for <dev@dpdk.org>; Wed, 29 Sep 2021 23:37:36 +0200 (CEST)
Received: by mail-wm1-f47.google.com with SMTP id
g19-20020a1c9d13000000b003075062d4daso2770245wme.0
for <dev@dpdk.org>; Wed, 29 Sep 2021 14:37:36 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=6wind.com; s=google;
h=from:to:cc:subject:date:message-id:in-reply-to:references
:mime-version:content-transfer-encoding;
bh=qW/WsSuBGRyBRpXb9qALTVvpOEfoYhrkG/vNCzDev2s=;
b=ELxh6rhfD8YMsOfNYzrquX7ZTAfNbot1QMinfwbIOWU6+1sRr+BfCTkINWg5h/Ni6B
xQRpQ6nI6Dtcps/w+vw0SjhsbQ+dI1UZ+AAtmWu8CtUN3NtTJGflUwqbM2DFX4rnK9C2
f/bGhg0S7IWzBVo0hEha7cg13Mws1HV7NxGeoAuUtDBWUL2anuhwZhrWFzdEiUUUdQ3i
p0VadIwz7/i+zJk1npZsPDOcW6UIGZ+6HUev+pUUTdHGYSldZe78fGTSbZPrzu9/ZvSs
TDX1PtT8vzMtrhcq8Zxc7Euw7Zo1DS7M2E1iRDCXO6RSDGaRiyAbdpD65offzG6Fmc9w
k5XQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20210112;
h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to
:references:mime-version:content-transfer-encoding;
bh=qW/WsSuBGRyBRpXb9qALTVvpOEfoYhrkG/vNCzDev2s=;
b=pG70BKa2Mb4/dONQxDCMMWR8BYfnmYQVUza4kR2BTmXdTivHJN/1s0UphkmzGxq/nL
MDRKnJSw8ft/p27HDbSq+iiIhZhkeJ6sjgveT0OBSW8VEdQnbqePhs9QydwOeeU76tnZ
Tp7WaledofDb/nI8am5tnkNZ7AlEMZQLX6h92h0romydHD2dwzenen7tz1g6fNcxNttS
jOt70G2crVEtuUDJal6E/dXepqpDyuZjTk8GFOSqaIfnvTEtxeAi+HrFHxsjwZXGsBBY
HP9Zn2CKBwwGiRkuoBxbeoSl7aLsvIgUqQ920KKtTrtmy8N7gSv9vUJIXcG81x2B68fW
y7Lg==
X-Gm-Message-State: AOAM5320wKkDcpx7g+uj2/bgCZceZ+5KLOEFQy8Gl9EGxSWJsjSfDKWT
7CQMs2Tv46d9Nm/Wt+V6AYBqkfosOyUKRw==
X-Google-Smtp-Source: ABdhPJypEUKE5cW+D9bU84LeVDgKPzOcHCvt4KZTHJxykgAQo1aOrVT2mIqD2KphjXIANqzJsIkPug==
X-Received: by 2002:a05:600c:c4:: with SMTP id
u4mr2148219wmm.194.1632951455699;
Wed, 29 Sep 2021 14:37:35 -0700 (PDT)
Received: from gojira.dev.6wind.com (host.78.145.23.62.rev.coltfrance.com.
[62.23.145.78])
by smtp.gmail.com with ESMTPSA id c8sm1067246wru.30.2021.09.29.14.37.34
(version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
Wed, 29 Sep 2021 14:37:35 -0700 (PDT)
From: Olivier Matz <olivier.matz@6wind.com>
To: dev@dpdk.org
Cc: ajit.khaparde@broadcom.com, ajitkhaparde@gmail.com, alialnu@nvidia.com,
andrew.rybchenko@oktetlabs.ru, konstantin.ananyev@intel.com,
mb@smartsharesystems.com, stable@dpdk.org, viacheslavo@nvidia.com
Date: Wed, 29 Sep 2021 23:37:07 +0200
Message-Id: <20210929213707.17727-1-olivier.matz@6wind.com>
X-Mailer: git-send-email 2.30.2
In-Reply-To: <20210113132734.1636-1-olivier.matz@6wind.com>
References: <20210113132734.1636-1-olivier.matz@6wind.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Subject: [dpdk-dev] [PATCH v5] mbuf: fix reset on mbuf free
X-BeenThere: dev@dpdk.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: DPDK patches and discussions <dev.dpdk.org>
List-Unsubscribe: <https://mails.dpdk.org/options/dev>,
<mailto:dev-request@dpdk.org?subject=unsubscribe>
List-Archive: <http://mails.dpdk.org/archives/dev/>
List-Post: <mailto:dev@dpdk.org>
List-Help: <mailto:dev-request@dpdk.org?subject=help>
List-Subscribe: <https://mails.dpdk.org/listinfo/dev>,
<mailto:dev-request@dpdk.org?subject=subscribe>
Errors-To: dev-bounces@dpdk.org
Sender: "dev" <dev-bounces@dpdk.org>
m->nb_seg must be reset on mbuf free whatever the value of m->next,
because it can happen that m->nb_seg is != 1. For instance in this
case:
m1 = rte_pktmbuf_alloc(mp);
rte_pktmbuf_append(m1, 500);
m2 = rte_pktmbuf_alloc(mp);
rte_pktmbuf_append(m2, 500);
rte_pktmbuf_chain(m1, m2);
m0 = rte_pktmbuf_alloc(mp);
rte_pktmbuf_append(m0, 500);
rte_pktmbuf_chain(m0, m1);
As rte_pktmbuf_chain() does not reset nb_seg in the initial m1
segment (this is not required), after this code the mbuf chain
have 3 segments:
- m0: next=m1, nb_seg=3
- m1: next=m2, nb_seg=2
- m2: next=NULL, nb_seg=1
Then split this chain between m1 and m2, it would result in 2 packets:
- first packet
- m0: next=m1, nb_seg=2
- m1: next=NULL, nb_seg=2
- second packet
- m2: next=NULL, nb_seg=1
Freeing the first packet will not restore nb_seg=1 in the second
segment. This is an issue because it is expected that mbufs stored
in pool have their nb_seg field set to 1.
Fixes: 8f094a9ac5d7 ("mbuf: set mbuf fields while in pool")
Cc: stable@dpdk.org
Signed-off-by: Olivier Matz <olivier.matz@6wind.com>
Acked-by: Morten Brørup <mb@smartsharesystems.com>
Acked-by: Ajit Khaparde <ajit.khaparde@broadcom.com>
Acked-by: Konstantin Ananyev <konstantin.ananyev@intel.com>
---
app/test/test_mbuf.c | 69 ++++++++++++++++++++++++++++++++++++++++
lib/mbuf/rte_mbuf.c | 4 +--
lib/mbuf/rte_mbuf.h | 8 ++---
lib/mbuf/rte_mbuf_core.h | 13 ++++++--
4 files changed, 86 insertions(+), 8 deletions(-)
diff --git a/app/test/test_mbuf.c b/app/test/test_mbuf.c
index 9a248dfaea..a4e32e933a 100644
--- a/app/test/test_mbuf.c
+++ b/app/test/test_mbuf.c
@@ -2684,6 +2684,70 @@ test_mbuf_dyn(struct rte_mempool *pktmbuf_pool)
return -1;
}
+/* check that m->nb_segs and m->next are reset on mbuf free */
+static int
+test_nb_segs_and_next_reset(void)
+{
+ struct rte_mbuf *m0 = NULL, *m1 = NULL, *m2 = NULL;
+ struct rte_mempool *pool = NULL;
+
+ pool = rte_pktmbuf_pool_create("test_mbuf_reset",
+ 3, 0, 0, MBUF_DATA_SIZE, SOCKET_ID_ANY);
+ if (pool == NULL)
+ GOTO_FAIL("Failed to create mbuf pool");
+
+ /* alloc mbufs */
+ m0 = rte_pktmbuf_alloc(pool);
+ m1 = rte_pktmbuf_alloc(pool);
+ m2 = rte_pktmbuf_alloc(pool);
+ if (m0 == NULL || m1 == NULL || m2 == NULL)
+ GOTO_FAIL("Failed to allocate mbuf");
+
+ /* append data in all of them */
+ if (rte_pktmbuf_append(m0, 500) == NULL ||
+ rte_pktmbuf_append(m1, 500) == NULL ||
+ rte_pktmbuf_append(m2, 500) == NULL)
+ GOTO_FAIL("Failed to append data in mbuf");
+
+ /* chain them in one mbuf m0 */
+ rte_pktmbuf_chain(m1, m2);
+ rte_pktmbuf_chain(m0, m1);
+ if (m0->nb_segs != 3 || m0->next != m1 || m1->next != m2 ||
+ m2->next != NULL) {
+ m1 = m2 = NULL;
+ GOTO_FAIL("Failed to chain mbufs");
+ }
+
+ /* split m0 chain in two, between m1 and m2 */
+ m0->nb_segs = 2;
+ m1->next = NULL;
+ m2->nb_segs = 1;
+
+ /* free the 2 mbuf chains m0 and m2 */
+ rte_pktmbuf_free(m0);
+ rte_pktmbuf_free(m2);
+
+ /* realloc the 3 mbufs */
+ m0 = rte_mbuf_raw_alloc(pool);
+ m1 = rte_mbuf_raw_alloc(pool);
+ m2 = rte_mbuf_raw_alloc(pool);
+ if (m0 == NULL || m1 == NULL || m2 == NULL)
+ GOTO_FAIL("Failed to reallocate mbuf");
+
+ /* ensure that m->next and m->nb_segs are reset allocated mbufs */
+ if (m0->nb_segs != 1 || m0->next != NULL ||
+ m1->nb_segs != 1 || m1->next != NULL ||
+ m2->nb_segs != 1 || m2->next != NULL)
+ GOTO_FAIL("nb_segs or next was not reset properly");
+
+ return 0;
+
+fail:
+ if (pool != NULL)
+ rte_mempool_free(pool);
+ return -1;
+}
+
static int
test_mbuf(void)
{
@@ -2874,6 +2938,11 @@ test_mbuf(void)
goto err;
}
+ /* test reset of m->nb_segs and m->next on mbuf free */
+ if (test_nb_segs_and_next_reset() < 0) {
+ printf("test_nb_segs_and_next_reset() failed\n");
+ goto err;
+ }
ret = 0;
err:
diff --git a/lib/mbuf/rte_mbuf.c b/lib/mbuf/rte_mbuf.c
index f7e3c1a187..f145cd800a 100644
--- a/lib/mbuf/rte_mbuf.c
+++ b/lib/mbuf/rte_mbuf.c
@@ -134,10 +134,10 @@ rte_pktmbuf_free_pinned_extmem(void *addr, void *opaque)
rte_mbuf_ext_refcnt_set(m->shinfo, 1);
m->ol_flags = EXT_ATTACHED_MBUF;
- if (m->next != NULL) {
+ if (m->next != NULL)
m->next = NULL;
+ if (m->nb_segs != 1)
m->nb_segs = 1;
- }
rte_mbuf_raw_free(m);
}
diff --git a/lib/mbuf/rte_mbuf.h b/lib/mbuf/rte_mbuf.h
index a555f216ae..dded3dd70c 100644
--- a/lib/mbuf/rte_mbuf.h
+++ b/lib/mbuf/rte_mbuf.h
@@ -1346,10 +1346,10 @@ rte_pktmbuf_prefree_seg(struct rte_mbuf *m)
return NULL;
}
- if (m->next != NULL) {
+ if (m->next != NULL)
m->next = NULL;
+ if (m->nb_segs != 1)
m->nb_segs = 1;
- }
return m;
@@ -1363,10 +1363,10 @@ rte_pktmbuf_prefree_seg(struct rte_mbuf *m)
return NULL;
}
- if (m->next != NULL) {
+ if (m->next != NULL)
m->next = NULL;
+ if (m->nb_segs != 1)
m->nb_segs = 1;
- }
rte_mbuf_refcnt_set(m, 1);
return m;
diff --git a/lib/mbuf/rte_mbuf_core.h b/lib/mbuf/rte_mbuf_core.h
index 9d8e3ddc86..9ef807daaa 100644
--- a/lib/mbuf/rte_mbuf_core.h
+++ b/lib/mbuf/rte_mbuf_core.h
@@ -508,7 +508,12 @@ struct rte_mbuf {
* or non-atomic) is controlled by the RTE_MBUF_REFCNT_ATOMIC flag.
*/
uint16_t refcnt;
- uint16_t nb_segs; /**< Number of segments. */
+
+ /**
+ * Number of segments. Only valid for the first segment of an mbuf
+ * chain.
+ */
+ uint16_t nb_segs;
/** Input port (16 bits to support more than 256 virtual ports).
* The event eth Tx adapter uses this field to specify the output port.
@@ -604,7 +609,11 @@ struct rte_mbuf {
/* second cache line - fields only used in slow path or on TX */
RTE_MARKER cacheline1 __rte_cache_min_aligned;
- struct rte_mbuf *next; /**< Next segment of scattered packet. */
+ /**
+ * Next segment of scattered packet. Must be NULL in the last segment or
+ * in case of non-segmented packet.
+ */
+ struct rte_mbuf *next;
/* fields to support TX offloads */
RTE_STD_C11
--
2.30.2