From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 5B6BF45B62 for ; Thu, 17 Oct 2024 21:20:52 +0200 (CEST) Received: from mails.dpdk.org (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 499A64064E; Thu, 17 Oct 2024 21:20:52 +0200 (CEST) Received: from linux.microsoft.com (linux.microsoft.com [13.77.154.182]) by mails.dpdk.org (Postfix) with ESMTP id 1FDC14025F; Thu, 17 Oct 2024 21:20:50 +0200 (CEST) Received: by linux.microsoft.com (Postfix, from userid 1202) id 397D320F9C3E; Thu, 17 Oct 2024 12:20:49 -0700 (PDT) DKIM-Filter: OpenDKIM Filter v2.11.0 linux.microsoft.com 397D320F9C3E DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxonhyperv.com; s=default; t=1729192849; bh=H8UDQPMmvLWLRDlD2lGdSAgMl7V8EuIosPpSFqTYmVs=; h=From:To:Cc:Subject:Date:Reply-To:From; b=eHn94TtOKKeiNewIsIi7p5BxVAW6jt1JAcVLvxPiy49VW+NHCthmW40l56T+HohvR Rw92C/7b2SavGNxfkNxRIru5Vd8Fxlj7ehuUsEDb1Mbrf7kz3lmVPNbHMf9RTWCG9O gYP9cmtD1ufoLS1Z1r12J20xLucW9M1wQI5lzqfo= From: longli@linuxonhyperv.com To: Ferruh Yigit , Andrew Rybchenko Cc: dev@dpdk.org, Alan Elder , sthemmin@microsoft.com, stable@dpdk.org, Long Li Subject: [Patch v5] net/netvsc: fix number Tx queues > Rx queues Date: Thu, 17 Oct 2024 12:20:29 -0700 Message-Id: <1729192829-30211-1-git-send-email-longli@linuxonhyperv.com> X-Mailer: git-send-email 1.8.3.1 X-BeenThere: stable@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: patches for DPDK stable branches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: longli@microsoft.com Errors-To: stable-bounces@dpdk.org From: Alan Elder The previous code allowed the number of Tx queues to be set higher than the number of Rx queues. If a packet was sent on a Tx queue with index >= number Rx queues there was a segfault due to accessing beyond the end of the dev->data->rx_queues[] array. This commit fixes the issue by creating an Rx queue for every Tx queue meaning that an event buffer is allocated to handle receiving Tx completion messages. mbuf pool and Rx ring are not allocated for these additional Rx queues and RSS configuration ensures that no packets are received on them. Fixes: 4e9c73e96e83 ("net/netvsc: add Hyper-V network device") Cc: sthemmin@microsoft.com Cc: stable@dpdk.org Signed-off-by: Alan Elder Signed-off-by: Long Li --- v5: * Resend/fixed up the last verison of the patch garbled in patchwork v4: * Include segfault core stack in commit message v3: * Handle case of Rx queue creation failure in hn_dev_tx_queue_setup. * Re-use rx queue if it has already been allocated. * Don't allocate an mbuf if pool is NULL. This avoids segfault if RSS configuration is incorrect. v2: * Remove function declaration for static non-member function drivers/net/netvsc/hn_ethdev.c | 9 +++++ drivers/net/netvsc/hn_rxtx.c | 68 +++++++++++++++++++++++++++++----- 2 files changed, 68 insertions(+), 9 deletions(-) diff --git a/drivers/net/netvsc/hn_ethdev.c b/drivers/net/netvsc/hn_ethdev.c index f8cb05a118..1736cb5d07 100644 --- a/drivers/net/netvsc/hn_ethdev.c +++ b/drivers/net/netvsc/hn_ethdev.c @@ -313,6 +313,15 @@ static int hn_rss_reta_update(struct rte_eth_dev *dev, if (reta_conf[idx].mask & mask) hv->rss_ind[i] = reta_conf[idx].reta[shift]; + + /* + * Ensure we don't allow config that directs traffic to an Rx + * queue that we aren't going to poll + */ + if (hv->rss_ind[i] >= dev->data->nb_rx_queues) { + PMD_DRV_LOG(ERR, "RSS distributing traffic to invalid Rx queue"); + return -EINVAL; + } } err = hn_rndis_conf_rss(hv, NDIS_RSS_FLAG_DISABLE); diff --git a/drivers/net/netvsc/hn_rxtx.c b/drivers/net/netvsc/hn_rxtx.c index 870f62e5fa..3e5386aaf1 100644 --- a/drivers/net/netvsc/hn_rxtx.c +++ b/drivers/net/netvsc/hn_rxtx.c @@ -222,6 +222,16 @@ static void hn_reset_txagg(struct hn_tx_queue *txq) txq->agg_prevpkt = NULL; } +static void +hn_rx_queue_free_common(struct hn_rx_queue *rxq) { + if (!rxq) + return; + + rte_free(rxq->rxbuf_info); + rte_free(rxq->event_buf); + rte_free(rxq); +} + int hn_dev_tx_queue_setup(struct rte_eth_dev *dev, uint16_t queue_idx, uint16_t nb_desc, @@ -231,6 +241,7 @@ hn_dev_tx_queue_setup(struct rte_eth_dev *dev, { struct hn_data *hv = dev->data->dev_private; struct hn_tx_queue *txq; + struct hn_rx_queue *rxq = NULL; char name[RTE_MEMPOOL_NAMESIZE]; uint32_t tx_free_thresh; int err = -ENOMEM; @@ -289,6 +300,27 @@ hn_dev_tx_queue_setup(struct rte_eth_dev *dev, goto error; } + /* + * If there are more Tx queues than Rx queues, allocate rx_queues + * with event buffer so that Tx completion messages can still be + * received + */ + if (queue_idx >= dev->data->nb_rx_queues) { + rxq = hn_rx_queue_alloc(hv, queue_idx, socket_id); + + if (!rxq) { + err = -ENOMEM; + goto error; + } + + /* + * Don't allocate mbuf pool or rx ring. RSS is always configured + * to ensure packets aren't received by this Rx queue. + */ + rxq->mb_pool = NULL; + rxq->rx_ring = NULL; + } + txq->agg_szmax = RTE_MIN(hv->chim_szmax, hv->rndis_agg_size); txq->agg_pktmax = hv->rndis_agg_pkts; txq->agg_align = hv->rndis_agg_align; @@ -299,12 +331,15 @@ hn_dev_tx_queue_setup(struct rte_eth_dev *dev, socket_id, tx_conf); if (err == 0) { dev->data->tx_queues[queue_idx] = txq; + if (rxq != NULL) + dev->data->rx_queues[queue_idx] = rxq; return 0; } error: rte_mempool_free(txq->txdesc_pool); rte_memzone_free(txq->tx_rndis_mz); + hn_rx_queue_free_common(rxq); rte_free(txq); return err; } @@ -351,6 +386,12 @@ hn_dev_tx_queue_release(struct rte_eth_dev *dev, uint16_t qid) if (!txq) return; + /* + * Free any Rx queues allocated for a Tx queue without a corresponding + * Rx queue + */ + if (qid >= dev->data->nb_rx_queues) + hn_rx_queue_free_common(dev->data->rx_queues[qid]); rte_mempool_free(txq->txdesc_pool); @@ -540,10 +581,12 @@ static void hn_rxpkt(struct hn_rx_queue *rxq, struct hn_rx_bufinfo *rxb, const struct hn_rxinfo *info) { struct hn_data *hv = rxq->hv; - struct rte_mbuf *m; + struct rte_mbuf *m = NULL; bool use_extbuf = false; - m = rte_pktmbuf_alloc(rxq->mb_pool); + if (likely(rxq->mb_pool != NULL)) + m = rte_pktmbuf_alloc(rxq->mb_pool); + if (unlikely(!m)) { struct rte_eth_dev *dev = &rte_eth_devices[rxq->port_id]; @@ -930,7 +973,15 @@ hn_dev_rx_queue_setup(struct rte_eth_dev *dev, if (queue_idx == 0) { rxq = hv->primary; } else { - rxq = hn_rx_queue_alloc(hv, queue_idx, socket_id); + /* + * If the number of Tx queues was previously greater than the + * number of Rx queues, we may already have allocated an rxq. + */ + if (!dev->data->rx_queues[queue_idx]) + rxq = hn_rx_queue_alloc(hv, queue_idx, socket_id); + else + rxq = dev->data->rx_queues[queue_idx]; + if (!rxq) return -ENOMEM; } @@ -963,9 +1014,10 @@ hn_dev_rx_queue_setup(struct rte_eth_dev *dev, fail: rte_ring_free(rxq->rx_ring); - rte_free(rxq->rxbuf_info); - rte_free(rxq->event_buf); - rte_free(rxq); + /* Only free rxq if it was created in this function. */ + if (!dev->data->rx_queues[queue_idx]) + hn_rx_queue_free_common(rxq); + return error; } @@ -986,9 +1038,7 @@ hn_rx_queue_free(struct hn_rx_queue *rxq, bool keep_primary) if (keep_primary && rxq == rxq->hv->primary) return; - rte_free(rxq->rxbuf_info); - rte_free(rxq->event_buf); - rte_free(rxq); + hn_rx_queue_free_common(rxq); } void -- 2.25.1