From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 5EE7643D04; Wed, 20 Mar 2024 15:52:50 +0100 (CET) Received: from mails.dpdk.org (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 098B641156; Wed, 20 Mar 2024 15:52:50 +0100 (CET) Received: from smtp-fw-9105.amazon.com (smtp-fw-9105.amazon.com [207.171.188.204]) by mails.dpdk.org (Postfix) with ESMTP id 7B178402B9; Wed, 20 Mar 2024 15:52:47 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.com; i=@amazon.com; q=dns/txt; s=amazon201209; t=1710946368; x=1742482368; h=from:to:cc:subject:date:message-id:mime-version; bh=AQupAN6y9L6gsTq9xXGLO1d5IupwS8r2PEbLNMYwcIU=; b=bL0VyCL1OAhbIroqM39uZEhkGAm3HW2azZIY3ufmtquRE2gaVuEl2/sB mU7XK9Bj1SuayUIFpjdPKeGAMnSOkgFV/6o6ixpXgLL97YbTpEi84W05J 8NVq5zGgvZf6hHLYk3gOGZN2UFvqLmbnvmrgjhK9jbIewgQs5BFI3cvw8 M=; X-IronPort-AV: E=Sophos;i="6.07,140,1708387200"; d="scan'208";a="712995764" Received: from pdx4-co-svc-p1-lb2-vlan2.amazon.com (HELO smtpout.prod.us-east-1.prod.farcaster.email.amazon.dev) ([10.25.36.210]) by smtp-border-fw-9105.sea19.amazon.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 20 Mar 2024 14:52:39 +0000 Received: from EX19MTAEUA002.ant.amazon.com [10.0.10.100:5408] by smtpin.naws.eu-west-1.prod.farcaster.email.amazon.dev [10.0.11.59:2525] with esmtp (Farcaster) id 76467fc5-590c-49b3-b49c-7a7089d26696; Wed, 20 Mar 2024 14:52:37 +0000 (UTC) X-Farcaster-Flow-ID: 76467fc5-590c-49b3-b49c-7a7089d26696 Received: from EX19D007EUA001.ant.amazon.com (10.252.50.133) by EX19MTAEUA002.ant.amazon.com (10.252.50.124) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1258.28; Wed, 20 Mar 2024 14:52:37 +0000 Received: from EX19MTAUWA001.ant.amazon.com (10.250.64.204) by EX19D007EUA001.ant.amazon.com (10.252.50.133) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1258.28; Wed, 20 Mar 2024 14:52:36 +0000 Received: from HFA15-CG15235BS.amazon.com (10.1.213.17) by mail-relay.amazon.com (10.250.64.204) with Microsoft SMTP Server id 15.2.1258.28 via Frontend Transport; Wed, 20 Mar 2024 14:52:34 +0000 From: To: CC: , Shai Brandes , Subject: [PATCH] net/ena: fix mbuf double free in fast free mode Date: Wed, 20 Mar 2024 16:52:32 +0200 Message-ID: <20240320145232.535-1-shaibran@amazon.com> X-Mailer: git-send-email 2.17.1 MIME-Version: 1.0 Content-Type: text/plain X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org From: Shai Brandes Fixed an issue of double free of mbufs which is exposed in mbuf fast free mode when handling multi-mbuf packets. The faulty patch mishandled free of non-head mbufs as it iterated over linked mbufs and collected them into an array, which was then passed to rte_pktmbuf_free_bulk. However, rte_pktmbuf_free_bulk already performs an internal iteration over mbufs that are linked together which led to double free. Fixes: 89b081e154c5 ("net/ena: fix fast mbuf free") Cc: stable@dpdk.org Signed-off-by: Shai Brandes --- drivers/net/ena/ena_ethdev.c | 39 +++++++++++------------------------- 1 file changed, 12 insertions(+), 27 deletions(-) diff --git a/drivers/net/ena/ena_ethdev.c b/drivers/net/ena/ena_ethdev.c index 7b697c150a..66fc287faf 100644 --- a/drivers/net/ena/ena_ethdev.c +++ b/drivers/net/ena/ena_ethdev.c @@ -48,10 +48,10 @@ #define MAX_WIDE_LLQ_DEPTH_UNSUPPORTED 0 /* - * We should try to keep ENA_CLEANUP_BUF_SIZE lower than + * We should try to keep ENA_CLEANUP_BUF_THRESH lower than * RTE_MEMPOOL_CACHE_MAX_SIZE, so we can fit this in mempool local cache. */ -#define ENA_CLEANUP_BUF_SIZE 256 +#define ENA_CLEANUP_BUF_THRESH 256 #define ENA_PTYPE_HAS_HASH (RTE_PTYPE_L4_TCP | RTE_PTYPE_L4_UDP) @@ -3180,32 +3180,12 @@ static int ena_xmit_mbuf(struct ena_ring *tx_ring, struct rte_mbuf *mbuf) return 0; } -static __rte_always_inline size_t -ena_tx_cleanup_mbuf_fast(struct rte_mbuf **mbufs_to_clean, - struct rte_mbuf *mbuf, - size_t mbuf_cnt, - size_t buf_size) -{ - struct rte_mbuf *m_next; - - while (mbuf != NULL) { - m_next = mbuf->next; - mbufs_to_clean[mbuf_cnt++] = mbuf; - if (mbuf_cnt == buf_size) { - rte_pktmbuf_free_bulk(mbufs_to_clean, mbuf_cnt); - mbuf_cnt = 0; - } - mbuf = m_next; - } - - return mbuf_cnt; -} - static int ena_tx_cleanup(void *txp, uint32_t free_pkt_cnt) { - struct rte_mbuf *mbufs_to_clean[ENA_CLEANUP_BUF_SIZE]; + struct rte_mbuf *pkts_to_clean[ENA_CLEANUP_BUF_THRESH]; struct ena_ring *tx_ring = (struct ena_ring *)txp; size_t mbuf_cnt = 0; + size_t pkt_cnt = 0; unsigned int total_tx_descs = 0; unsigned int total_tx_pkts = 0; uint16_t cleanup_budget; @@ -3236,8 +3216,13 @@ static int ena_tx_cleanup(void *txp, uint32_t free_pkt_cnt) mbuf = tx_info->mbuf; if (fast_free) { - mbuf_cnt = ena_tx_cleanup_mbuf_fast(mbufs_to_clean, mbuf, mbuf_cnt, - ENA_CLEANUP_BUF_SIZE); + pkts_to_clean[pkt_cnt++] = mbuf; + mbuf_cnt += mbuf->nb_segs; + if (mbuf_cnt >= ENA_CLEANUP_BUF_THRESH) { + rte_pktmbuf_free_bulk(pkts_to_clean, pkt_cnt); + mbuf_cnt = 0; + pkt_cnt = 0; + } } else { rte_pktmbuf_free(mbuf); } @@ -3260,7 +3245,7 @@ static int ena_tx_cleanup(void *txp, uint32_t free_pkt_cnt) } if (mbuf_cnt != 0) - rte_pktmbuf_free_bulk(mbufs_to_clean, mbuf_cnt); + rte_pktmbuf_free_bulk(pkts_to_clean, pkt_cnt); /* Notify completion handler that full cleanup was performed */ if (free_pkt_cnt == 0 || total_tx_pkts < cleanup_budget) -- 2.17.1