From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id F12D3A0C4C; Tue, 21 Sep 2021 10:46:32 +0200 (CEST) Received: from [217.70.189.124] (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 6E56F40683; Tue, 21 Sep 2021 10:46:32 +0200 (CEST) Received: from mail-il1-f172.google.com (mail-il1-f172.google.com [209.85.166.172]) by mails.dpdk.org (Postfix) with ESMTP id 25DA24003C; Tue, 21 Sep 2021 10:46:31 +0200 (CEST) Received: by mail-il1-f172.google.com with SMTP id i13so21779133ilm.4; Tue, 21 Sep 2021 01:46:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=fArWVYMAk5IjlxNTyIvtylJcYMsrz4YFJC6tRLDiSuc=; b=ieXzLjl0dlb4u14QXWEykqAFGWCbeha91gmvCvj0QcOOmTx2LryOZ0pVfgG+7D2nqT B3WdvF2P5EdM5GTiyCQrhHs9aqMFNMyLJZhhCk10Cfzw6fW/bNHxLmb1Y6vDktLX+MEO KNw/Rgo3smuxFL/ECYVN0iIG4OnD80c9JVomRld/RoCjuxKLcgjUBP5OwYWZKgqCdjAE 10CmMF4TQTB8CdPopFK2oTL8R+oxZ3ssQW7I0+eHhqCNu5omLQyBqhrWE2j7AEbvHfTK 1GlPa7qt1TjiRmzu5QXNwFgSYiOy4110zsL/+obXDFDnBmhAe0+PAWKZ/6XJ72VCXFb/ XGoA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=fArWVYMAk5IjlxNTyIvtylJcYMsrz4YFJC6tRLDiSuc=; b=ypFaK6l5o/Dxlmyj5mRte6Q91QQ+CES2fSufRjf7Cs/MI9YA34V7yiQx58Umu1JOp4 JsOQE7HXO97aRUlMwWJNcPhyWiIYsbfVL8CiLF11yd1yHDTsw9fO+DuesndMBaxMr5X9 ti7R/mkCwDSohAbAu7xB06jofRJbJBX1kzJCY1hvh7No2mqcAIV9Xe2FGFO9QRcliQqE TPhW+e7kG0p+GMNoAIEf8n9MqJDauIcCNKPomI5AkK8PsA0Yy2NoW4Ko5zbYTRDGs+Bg F1K8xbsg+tEFV6bCjdJS97tiARU3K86wGp3LlcMpySXK7tJOJ4xJwltDsjwpjpf/IHCV 3icg== X-Gm-Message-State: AOAM533kXsVRlsEQZQygV2A99x85d9m+aj0QSu2KZNNK9TPeHpxGY3IE 9DubgqQxwvmAhwlL6qyj+DJV+9OSt/BxDhTw+ks= X-Google-Smtp-Source: ABdhPJz/xL1AP/wT4QA3dG6ISdki0ESK4GcKrfoY7o8SM7mnQMz7r8ld8Na3ZSDyybmx8ozHBPj/MjcUMvB4yRIEP1Q= X-Received: by 2002:a05:6e02:1b03:: with SMTP id i3mr1978384ilv.251.1632213990337; Tue, 21 Sep 2021 01:46:30 -0700 (PDT) MIME-Version: 1.0 References: <20210920144925.118704-1-hkalra@marvell.com> In-Reply-To: <20210920144925.118704-1-hkalra@marvell.com> From: Jerin Jacob Date: Tue, 21 Sep 2021 14:16:03 +0530 Message-ID: To: Harman Kalra , Ferruh Yigit Cc: dpdk-dev , dpdk stable , David George Content-Type: text/plain; charset="UTF-8" Subject: Re: [dpdk-dev] [PATCH] net/octeontx: fix invalid access to indirect buffers X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" On Mon, Sep 20, 2021 at 8:19 PM Harman Kalra wrote: > > Issue has been observed where fields of indirect buffers are > accessed after being set free by the diver. Also fixing freeing > of direct buffers to correct aura. > > Fixes: 5cbe184802aa ("net/octeontx: support fast mbuf free") > Cc: stable@dpdk.org > > Signed-off-by: David George > Signed-off-by: Harman Kalra Acked-by: Jerin Jacob Applied to dpdk-next-net-mrvl/for-next-net. Thanks > --- > drivers/net/octeontx/octeontx_rxtx.h | 69 ++++++++++++++++++---------- > 1 file changed, 46 insertions(+), 23 deletions(-) > > diff --git a/drivers/net/octeontx/octeontx_rxtx.h b/drivers/net/octeontx/octeontx_rxtx.h > index 2ed28ea563..e0723ac26a 100644 > --- a/drivers/net/octeontx/octeontx_rxtx.h > +++ b/drivers/net/octeontx/octeontx_rxtx.h > @@ -161,7 +161,7 @@ ptype_table[PTYPE_SIZE][PTYPE_SIZE][PTYPE_SIZE] = { > > > static __rte_always_inline uint64_t > -octeontx_pktmbuf_detach(struct rte_mbuf *m) > +octeontx_pktmbuf_detach(struct rte_mbuf *m, struct rte_mbuf **m_tofree) > { > struct rte_mempool *mp = m->pool; > uint32_t mbuf_size, buf_len; > @@ -171,6 +171,8 @@ octeontx_pktmbuf_detach(struct rte_mbuf *m) > > /* Update refcount of direct mbuf */ > md = rte_mbuf_from_indirect(m); > + /* The real data will be in the direct buffer, inform callers this */ > + *m_tofree = md; > refcount = rte_mbuf_refcnt_update(md, -1); > > priv_size = rte_pktmbuf_priv_size(mp); > @@ -203,18 +205,18 @@ octeontx_pktmbuf_detach(struct rte_mbuf *m) > } > > static __rte_always_inline uint64_t > -octeontx_prefree_seg(struct rte_mbuf *m) > +octeontx_prefree_seg(struct rte_mbuf *m, struct rte_mbuf **m_tofree) > { > if (likely(rte_mbuf_refcnt_read(m) == 1)) { > if (!RTE_MBUF_DIRECT(m)) > - return octeontx_pktmbuf_detach(m); > + return octeontx_pktmbuf_detach(m, m_tofree); > > m->next = NULL; > m->nb_segs = 1; > return 0; > } else if (rte_mbuf_refcnt_update(m, -1) == 0) { > if (!RTE_MBUF_DIRECT(m)) > - return octeontx_pktmbuf_detach(m); > + return octeontx_pktmbuf_detach(m, m_tofree); > > rte_mbuf_refcnt_set(m, 1); > m->next = NULL; > @@ -315,6 +317,14 @@ __octeontx_xmit_prepare(struct rte_mbuf *tx_pkt, uint64_t *cmd_buf, > const uint16_t flag) > { > uint16_t gaura_id, nb_desc = 0; > + struct rte_mbuf *m_tofree; > + rte_iova_t iova; > + uint16_t data_len; > + > + m_tofree = tx_pkt; > + > + data_len = tx_pkt->data_len; > + iova = rte_mbuf_data_iova(tx_pkt); > > /* Setup PKO_SEND_HDR_S */ > cmd_buf[nb_desc++] = tx_pkt->data_len & 0xffff; > @@ -329,22 +339,23 @@ __octeontx_xmit_prepare(struct rte_mbuf *tx_pkt, uint64_t *cmd_buf, > * not, as SG_DESC[I] and SEND_HDR[II] are clear. > */ > if (flag & OCCTX_TX_OFFLOAD_MBUF_NOFF_F) > - cmd_buf[0] |= (octeontx_prefree_seg(tx_pkt) << > + cmd_buf[0] |= (octeontx_prefree_seg(tx_pkt, &m_tofree) << > 58); > > /* Mark mempool object as "put" since it is freed by PKO */ > if (!(cmd_buf[0] & (1ULL << 58))) > - __mempool_check_cookies(tx_pkt->pool, (void **)&tx_pkt, > + __mempool_check_cookies(m_tofree->pool, (void **)&m_tofree, > 1, 0); > /* Get the gaura Id */ > - gaura_id = octeontx_fpa_bufpool_gaura((uintptr_t)tx_pkt->pool->pool_id); > + gaura_id = > + octeontx_fpa_bufpool_gaura((uintptr_t)m_tofree->pool->pool_id); > > /* Setup PKO_SEND_BUFLINK_S */ > cmd_buf[nb_desc++] = PKO_SEND_BUFLINK_SUBDC | > PKO_SEND_BUFLINK_LDTYPE(0x1ull) | > PKO_SEND_BUFLINK_GAUAR((long)gaura_id) | > - tx_pkt->data_len; > - cmd_buf[nb_desc++] = rte_mbuf_data_iova(tx_pkt); > + data_len; > + cmd_buf[nb_desc++] = iova; > > return nb_desc; > } > @@ -355,7 +366,9 @@ __octeontx_xmit_mseg_prepare(struct rte_mbuf *tx_pkt, uint64_t *cmd_buf, > { > uint16_t nb_segs, nb_desc = 0; > uint16_t gaura_id, len = 0; > - struct rte_mbuf *m_next = NULL; > + struct rte_mbuf *m_next = NULL, *m_tofree; > + rte_iova_t iova; > + uint16_t data_len; > > nb_segs = tx_pkt->nb_segs; > /* Setup PKO_SEND_HDR_S */ > @@ -369,40 +382,50 @@ __octeontx_xmit_mseg_prepare(struct rte_mbuf *tx_pkt, uint64_t *cmd_buf, > > do { > m_next = tx_pkt->next; > - /* To handle case where mbufs belong to diff pools, like > - * fragmentation > + /* Get TX parameters up front, octeontx_prefree_seg might change > + * them > */ > - gaura_id = octeontx_fpa_bufpool_gaura((uintptr_t) > - tx_pkt->pool->pool_id); > + m_tofree = tx_pkt; > + data_len = tx_pkt->data_len; > + iova = rte_mbuf_data_iova(tx_pkt); > > /* Setup PKO_SEND_GATHER_S */ > - cmd_buf[nb_desc] = PKO_SEND_GATHER_SUBDC | > - PKO_SEND_GATHER_LDTYPE(0x1ull) | > - PKO_SEND_GATHER_GAUAR((long)gaura_id) | > - tx_pkt->data_len; > + cmd_buf[nb_desc] = 0; > > /* SG_DESC[I] bit controls if buffer is to be freed or > * not, as SEND_HDR[DF] and SEND_HDR[II] are clear. > */ > if (flag & OCCTX_TX_OFFLOAD_MBUF_NOFF_F) { > cmd_buf[nb_desc] |= > - (octeontx_prefree_seg(tx_pkt) << 57); > + (octeontx_prefree_seg(tx_pkt, &m_tofree) << 57); > } > > + /* To handle case where mbufs belong to diff pools, like > + * fragmentation > + */ > + gaura_id = octeontx_fpa_bufpool_gaura((uintptr_t) > + m_tofree->pool->pool_id); > + > + /* Setup PKO_SEND_GATHER_S */ > + cmd_buf[nb_desc] |= PKO_SEND_GATHER_SUBDC | > + PKO_SEND_GATHER_LDTYPE(0x1ull) | > + PKO_SEND_GATHER_GAUAR((long)gaura_id) | > + data_len; > + > /* Mark mempool object as "put" since it is freed by > * PKO. > */ > if (!(cmd_buf[nb_desc] & (1ULL << 57))) { > tx_pkt->next = NULL; > - __mempool_check_cookies(tx_pkt->pool, > - (void **)&tx_pkt, 1, 0); > + __mempool_check_cookies(m_tofree->pool, > + (void **)&m_tofree, 1, 0); > } > nb_desc++; > > - cmd_buf[nb_desc++] = rte_mbuf_data_iova(tx_pkt); > + cmd_buf[nb_desc++] = iova; > > nb_segs--; > - len += tx_pkt->data_len; > + len += data_len; > tx_pkt = m_next; > } while (nb_segs); > > -- > 2.18.0 >