[PATCH] net/virtio: fix crash when dev is configured twice

[PATCH] net/virtio: fix crash when dev is configured twice

[Alexander Chernavin]

When first attempt to configure a device with RX interrupt enabled fails
for some reason (e.g. because "Multiple intr vector not supported"),
second attempt to configure the device with RX interrupt disabled and
feature set unchanged will succeed but will leave virtio queues not
allocated. Accessing the queues will cause a segfault.

First attempt:
  - virtio_dev_configure()
    - virtio_init_device() is called to reinit the device because
      "dev->data->dev_conf.intr_conf.rxq" is "1"
      - virtio_configure_intr() fails and returns an error
      - virtio_free_queues() frees previously allocated virtio queues
    - virtio_init_device() fails and returns an error
  - virtio_dev_configure() fails and returns an error

Second attempt:
  - virtio_dev_configure()
    - This time virtio_init_device() is not called, virtio queues
      are not allocated

With this fix, reinit the device during configuration if virtio queues
are not allocated.

Signed-off-by: Alexander Chernavin <achernavin@netgate.com>
---
 drivers/net/virtio/virtio_ethdev.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/net/virtio/virtio_ethdev.c b/drivers/net/virtio/virtio_ethdev.c
index d180162abd..38bfe050b5 100644
--- a/drivers/net/virtio/virtio_ethdev.c
+++ b/drivers/net/virtio/virtio_ethdev.c
@@ -2616,6 +2616,13 @@ virtio_dev_configure(struct rte_eth_dev *dev)
 			return ret;
 	}
 
+	/* if queues are not allocated, reinit the device */
+	if (hw->vqs == NULL) {
+		ret = virtio_init_device(dev, hw->req_guest_features);
+		if (ret < 0)
+			return ret;
+	}
+
 	if ((rxmode->mq_mode & RTE_ETH_MQ_RX_RSS_FLAG) &&
 			!virtio_with_feature(hw, VIRTIO_NET_F_RSS)) {
 		PMD_DRV_LOG(ERR, "RSS support requested but not supported by the device");
-- 
2.25.1

RE: [PATCH] net/virtio: fix crash when dev is configured twice

[Xia, Chenbo]

> -----Original Message-----
> From: Alexander Chernavin <achernavin@netgate.com>
> Sent: Wednesday, August 31, 2022 4:54 PM
> To: maxime.coquelin@redhat.com; Xia, Chenbo <chenbo.xia@intel.com>
> Cc: dev@dpdk.org; Alexander Chernavin <achernavin@netgate.com>
> Subject: [PATCH] net/virtio: fix crash when dev is configured twice
> 
> When first attempt to configure a device with RX interrupt enabled fails
> for some reason (e.g. because "Multiple intr vector not supported"),
> second attempt to configure the device with RX interrupt disabled and
> feature set unchanged will succeed but will leave virtio queues not
> allocated. Accessing the queues will cause a segfault.
> 
> First attempt:
>   - virtio_dev_configure()
>     - virtio_init_device() is called to reinit the device because
>       "dev->data->dev_conf.intr_conf.rxq" is "1"
>       - virtio_configure_intr() fails and returns an error
>       - virtio_free_queues() frees previously allocated virtio queues
>     - virtio_init_device() fails and returns an error
>   - virtio_dev_configure() fails and returns an error
> 
> Second attempt:
>   - virtio_dev_configure()
>     - This time virtio_init_device() is not called, virtio queues
>       are not allocated
> 
> With this fix, reinit the device during configuration if virtio queues
> are not allocated.

Good catch. This is a fix, we should backport it, let's add fix and cc-stable
Tag.

Thanks,
Chenbo 

> 
> Signed-off-by: Alexander Chernavin <achernavin@netgate.com>
> ---
>  drivers/net/virtio/virtio_ethdev.c | 7 +++++++
>  1 file changed, 7 insertions(+)
> 
> diff --git a/drivers/net/virtio/virtio_ethdev.c
> b/drivers/net/virtio/virtio_ethdev.c
> index d180162abd..38bfe050b5 100644
> --- a/drivers/net/virtio/virtio_ethdev.c
> +++ b/drivers/net/virtio/virtio_ethdev.c
> @@ -2616,6 +2616,13 @@ virtio_dev_configure(struct rte_eth_dev *dev)
>  			return ret;
>  	}
> 
> +	/* if queues are not allocated, reinit the device */
> +	if (hw->vqs == NULL) {
> +		ret = virtio_init_device(dev, hw->req_guest_features);
> +		if (ret < 0)
> +			return ret;
> +	}
> +
>  	if ((rxmode->mq_mode & RTE_ETH_MQ_RX_RSS_FLAG) &&
>  			!virtio_with_feature(hw, VIRTIO_NET_F_RSS)) {
>  		PMD_DRV_LOG(ERR, "RSS support requested but not supported by
> the device");
> --
> 2.25.1

[PATCH v2] net/virtio: fix crash when dev is configured twice

[Alexander Chernavin]

When first attempt to configure a device with RX interrupt enabled fails
for some reason (e.g. because "Multiple intr vector not supported"),
second attempt to configure the device with RX interrupt disabled and
feature set unchanged will succeed but will leave virtio queues not
allocated. Accessing the queues will cause a segfault.

First attempt:
  - virtio_dev_configure()
    - virtio_init_device() is called to reinit the device because
      "dev->data->dev_conf.intr_conf.rxq" is "1"
      - virtio_configure_intr() fails and returns an error
      - virtio_free_queues() frees previously allocated virtio queues
    - virtio_init_device() fails and returns an error
  - virtio_dev_configure() fails and returns an error

Second attempt:
  - virtio_dev_configure()
    - This time virtio_init_device() is not called, virtio queues
      are not allocated

With this fix, reinit the device during configuration if virtio queues
are not allocated.

Cc: stable@dpdk.org

Signed-off-by: Alexander Chernavin <achernavin@netgate.com>
---
v2:
* Also CC to stable@dpdk.org

 drivers/net/virtio/virtio_ethdev.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/net/virtio/virtio_ethdev.c b/drivers/net/virtio/virtio_ethdev.c
index d180162abd..38bfe050b5 100644
--- a/drivers/net/virtio/virtio_ethdev.c
+++ b/drivers/net/virtio/virtio_ethdev.c
@@ -2616,6 +2616,13 @@ virtio_dev_configure(struct rte_eth_dev *dev)
 			return ret;
 	}
 
+	/* if queues are not allocated, reinit the device */
+	if (hw->vqs == NULL) {
+		ret = virtio_init_device(dev, hw->req_guest_features);
+		if (ret < 0)
+			return ret;
+	}
+
 	if ((rxmode->mq_mode & RTE_ETH_MQ_RX_RSS_FLAG) &&
 			!virtio_with_feature(hw, VIRTIO_NET_F_RSS)) {
 		PMD_DRV_LOG(ERR, "RSS support requested but not supported by the device");
-- 
2.25.1

[PATCH v3] net/virtio: fix crash when dev is configured twice

[Alexander Chernavin]

When first attempt to configure a device with RX interrupt enabled fails
for some reason (e.g. because "Multiple intr vector not supported"),
second attempt to configure the device with RX interrupt disabled and
feature set unchanged will succeed but will leave virtio queues not
allocated. Accessing the queues will cause a segfault.

First attempt:
  - virtio_dev_configure()
    - virtio_init_device() is called to reinit the device because
      "dev->data->dev_conf.intr_conf.rxq" is "1"
      - virtio_configure_intr() fails and returns an error
      - virtio_free_queues() frees previously allocated virtio queues
    - virtio_init_device() fails and returns an error
  - virtio_dev_configure() fails and returns an error

Second attempt:
  - virtio_dev_configure()
    - This time virtio_init_device() is not called, virtio queues
      are not allocated

With this fix, reinit the device during configuration if virtio queues
are not allocated.

Fixes: 2b38151f745a ("net/virtio: fix queue memory leak on error")
Cc: stable@dpdk.org

Signed-off-by: Alexander Chernavin <achernavin@netgate.com>
---
v2: Add Cc: stable@dpdk.org
v3: Add Fixes: 2b38151f745a

 drivers/net/virtio/virtio_ethdev.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/net/virtio/virtio_ethdev.c b/drivers/net/virtio/virtio_ethdev.c
index d180162abd..38bfe050b5 100644
--- a/drivers/net/virtio/virtio_ethdev.c
+++ b/drivers/net/virtio/virtio_ethdev.c
@@ -2616,6 +2616,13 @@ virtio_dev_configure(struct rte_eth_dev *dev)
 			return ret;
 	}
 
+	/* if queues are not allocated, reinit the device */
+	if (hw->vqs == NULL) {
+		ret = virtio_init_device(dev, hw->req_guest_features);
+		if (ret < 0)
+			return ret;
+	}
+
 	if ((rxmode->mq_mode & RTE_ETH_MQ_RX_RSS_FLAG) &&
 			!virtio_with_feature(hw, VIRTIO_NET_F_RSS)) {
 		PMD_DRV_LOG(ERR, "RSS support requested but not supported by the device");
-- 
2.25.1

RE: [PATCH v3] net/virtio: fix crash when dev is configured twice

[Xia, Chenbo]

> -----Original Message-----
> From: Alexander Chernavin <achernavin@netgate.com>
> Sent: Tuesday, September 27, 2022 6:15 PM
> To: Xia, Chenbo <chenbo.xia@intel.com>; maxime.coquelin@redhat.com
> Cc: dev@dpdk.org; Alexander Chernavin <achernavin@netgate.com>;
> stable@dpdk.org
> Subject: [PATCH v3] net/virtio: fix crash when dev is configured twice
> 
> When first attempt to configure a device with RX interrupt enabled fails
> for some reason (e.g. because "Multiple intr vector not supported"),
> second attempt to configure the device with RX interrupt disabled and
> feature set unchanged will succeed but will leave virtio queues not
> allocated. Accessing the queues will cause a segfault.
> 
> First attempt:
>   - virtio_dev_configure()
>     - virtio_init_device() is called to reinit the device because
>       "dev->data->dev_conf.intr_conf.rxq" is "1"
>       - virtio_configure_intr() fails and returns an error
>       - virtio_free_queues() frees previously allocated virtio queues
>     - virtio_init_device() fails and returns an error
>   - virtio_dev_configure() fails and returns an error
> 
> Second attempt:
>   - virtio_dev_configure()
>     - This time virtio_init_device() is not called, virtio queues
>       are not allocated
> 
> With this fix, reinit the device during configuration if virtio queues
> are not allocated.
> 
> Fixes: 2b38151f745a ("net/virtio: fix queue memory leak on error")
> Cc: stable@dpdk.org
> 
> Signed-off-by: Alexander Chernavin <achernavin@netgate.com>
> ---
> v2: Add Cc: stable@dpdk.org
> v3: Add Fixes: 2b38151f745a
> 
>  drivers/net/virtio/virtio_ethdev.c | 7 +++++++
>  1 file changed, 7 insertions(+)
> 
> diff --git a/drivers/net/virtio/virtio_ethdev.c
> b/drivers/net/virtio/virtio_ethdev.c
> index d180162abd..38bfe050b5 100644
> --- a/drivers/net/virtio/virtio_ethdev.c
> +++ b/drivers/net/virtio/virtio_ethdev.c
> @@ -2616,6 +2616,13 @@ virtio_dev_configure(struct rte_eth_dev *dev)
>  			return ret;
>  	}
> 
> +	/* if queues are not allocated, reinit the device */
> +	if (hw->vqs == NULL) {
> +		ret = virtio_init_device(dev, hw->req_guest_features);
> +		if (ret < 0)
> +			return ret;
> +	}
> +
>  	if ((rxmode->mq_mode & RTE_ETH_MQ_RX_RSS_FLAG) &&
>  			!virtio_with_feature(hw, VIRTIO_NET_F_RSS)) {
>  		PMD_DRV_LOG(ERR, "RSS support requested but not supported by
> the device");
> --
> 2.25.1

Reviewed-by: Chenbo Xia <chenbo.xia@intel.com>

RE: [PATCH v3] net/virtio: fix crash when dev is configured twice

[Xia, Chenbo]

> -----Original Message-----
> From: Xia, Chenbo <chenbo.xia@intel.com>
> Sent: Wednesday, September 28, 2022 12:47 PM
> To: Alexander Chernavin <achernavin@netgate.com>;
> maxime.coquelin@redhat.com
> Cc: dev@dpdk.org; stable@dpdk.org
> Subject: RE: [PATCH v3] net/virtio: fix crash when dev is configured twice
> 
> > -----Original Message-----
> > From: Alexander Chernavin <achernavin@netgate.com>
> > Sent: Tuesday, September 27, 2022 6:15 PM
> > To: Xia, Chenbo <chenbo.xia@intel.com>; maxime.coquelin@redhat.com
> > Cc: dev@dpdk.org; Alexander Chernavin <achernavin@netgate.com>;
> > stable@dpdk.org
> > Subject: [PATCH v3] net/virtio: fix crash when dev is configured twice
> >
> > When first attempt to configure a device with RX interrupt enabled fails
> > for some reason (e.g. because "Multiple intr vector not supported"),
> > second attempt to configure the device with RX interrupt disabled and
> > feature set unchanged will succeed but will leave virtio queues not
> > allocated. Accessing the queues will cause a segfault.
> >
> > First attempt:
> >   - virtio_dev_configure()
> >     - virtio_init_device() is called to reinit the device because
> >       "dev->data->dev_conf.intr_conf.rxq" is "1"
> >       - virtio_configure_intr() fails and returns an error
> >       - virtio_free_queues() frees previously allocated virtio queues
> >     - virtio_init_device() fails and returns an error
> >   - virtio_dev_configure() fails and returns an error
> >
> > Second attempt:
> >   - virtio_dev_configure()
> >     - This time virtio_init_device() is not called, virtio queues
> >       are not allocated
> >
> > With this fix, reinit the device during configuration if virtio queues
> > are not allocated.
> >
> > Fixes: 2b38151f745a ("net/virtio: fix queue memory leak on error")
> > Cc: stable@dpdk.org
> >
> > Signed-off-by: Alexander Chernavin <achernavin@netgate.com>
> > ---
> > v2: Add Cc: stable@dpdk.org
> > v3: Add Fixes: 2b38151f745a
> >
> >  drivers/net/virtio/virtio_ethdev.c | 7 +++++++
> >  1 file changed, 7 insertions(+)
> >
> > diff --git a/drivers/net/virtio/virtio_ethdev.c
> > b/drivers/net/virtio/virtio_ethdev.c
> > index d180162abd..38bfe050b5 100644
> > --- a/drivers/net/virtio/virtio_ethdev.c
> > +++ b/drivers/net/virtio/virtio_ethdev.c
> > @@ -2616,6 +2616,13 @@ virtio_dev_configure(struct rte_eth_dev *dev)
> >  			return ret;
> >  	}
> >
> > +	/* if queues are not allocated, reinit the device */
> > +	if (hw->vqs == NULL) {
> > +		ret = virtio_init_device(dev, hw->req_guest_features);
> > +		if (ret < 0)
> > +			return ret;
> > +	}
> > +
> >  	if ((rxmode->mq_mode & RTE_ETH_MQ_RX_RSS_FLAG) &&
> >  			!virtio_with_feature(hw, VIRTIO_NET_F_RSS)) {
> >  		PMD_DRV_LOG(ERR, "RSS support requested but not supported by
> > the device");
> > --
> > 2.25.1
> 
> Reviewed-by: Chenbo Xia <chenbo.xia@intel.com>

Applied to next-virtio/main, thanks

[PATCH v2] net/virtio: fix crash when dev is configured twice

[Alexander Chernavin]

When first attempt to configure a device with RX interrupt enabled fails
for some reason (e.g. because "Multiple intr vector not supported"),
second attempt to configure the device with RX interrupt disabled and
feature set unchanged will succeed but will leave virtio queues not
allocated. Accessing the queues will cause a segfault.

First attempt:
  - virtio_dev_configure()
    - virtio_init_device() is called to reinit the device because
      "dev->data->dev_conf.intr_conf.rxq" is "1"
      - virtio_configure_intr() fails and returns an error
      - virtio_free_queues() frees previously allocated virtio queues
    - virtio_init_device() fails and returns an error
  - virtio_dev_configure() fails and returns an error

Second attempt:
  - virtio_dev_configure()
    - This time virtio_init_device() is not called, virtio queues
      are not allocated

With this fix, reinit the device during configuration if virtio queues
are not allocated.

Cc: stable@dpdk.org

Signed-off-by: Alexander Chernavin <achernavin@netgate.com>
---
v2:
* Also CC to stable@dpdk.org

 drivers/net/virtio/virtio_ethdev.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/net/virtio/virtio_ethdev.c b/drivers/net/virtio/virtio_ethdev.c
index d180162abd..38bfe050b5 100644
--- a/drivers/net/virtio/virtio_ethdev.c
+++ b/drivers/net/virtio/virtio_ethdev.c
@@ -2616,6 +2616,13 @@ virtio_dev_configure(struct rte_eth_dev *dev)
 			return ret;
 	}
 
+	/* if queues are not allocated, reinit the device */
+	if (hw->vqs == NULL) {
+		ret = virtio_init_device(dev, hw->req_guest_features);
+		if (ret < 0)
+			return ret;
+	}
+
 	if ((rxmode->mq_mode & RTE_ETH_MQ_RX_RSS_FLAG) &&
 			!virtio_with_feature(hw, VIRTIO_NET_F_RSS)) {
 		PMD_DRV_LOG(ERR, "RSS support requested but not supported by the device");
-- 
2.25.1