From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 440C743E57 for ; Sat, 13 Apr 2024 15:00:52 +0200 (CEST) Received: from mails.dpdk.org (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 3A61F40E8A; Sat, 13 Apr 2024 15:00:52 +0200 (CEST) Received: from NAM12-BN8-obe.outbound.protection.outlook.com (mail-bn8nam12on2089.outbound.protection.outlook.com [40.107.237.89]) by mails.dpdk.org (Postfix) with ESMTP id 2346940E32 for ; Sat, 13 Apr 2024 15:00:51 +0200 (CEST) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=eejDAiQBKEcMiUlvjcj9Zg5DPy/l/Av5UFSW82v+xf2wrB85SKsgiCXYQUJ8ecjY1q1z2tvcxTN4Sxd5aYGy5aQhzCZHeKADTab6CnMAdsuBHTonDJbgQY7i5kZOrr2zUIVSG5ZgTiwhypAuJQCkBOXB8holecxPTj5v3ftDlHM76MMUs9kRqutKSVwjSgdf86Qalvfh2eP+LeyQtqSEUh/SYQwHTedfqmuoOvFuu8aDZtC+4L/4Hz4eaCcdR/yFZOA9NLVomZeqQI5Yzy2ouuh1XI+5NLrodjGY2xFW6VkPSy/upxM2t1ibsoyasXAnVZsV18mafzrWgLVULnsEQQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=PBV1jKr2SAQE6pQekdVX5hJZlX2szBTXttlcGMO2HEg=; b=ZB2cslw3Zq55kpnuym/QMeSSe3I2GOXCfZyAl0XpY2fcb1zMDhJt4pPmSrQsTNXTsoWrzG9BeDN5exMjYoVPX7xhzklChNijQMYXDixNnkPG8K84eG3bV399Kmo09r6RQDkfM8Qj0nYcoXw0ZAdof8ZsRvEUEjUYeMaRbdvd2K2Vplgs3QECOf7Hrwkf9fS/POJdmAxGLdSTvG59TdQUIVvaeq/CfB3E5vl0A8hmq6LbrT51zr0+qP8JN5O6Z88G1Ei9P9BT/WdHuJwwHJ3Ax1jdJOUK7vWF7aIns9XZ6upR3AFsTN38GJUZmn1vRJENJ7pLRxQydT2muSMD2r3exQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.117.161) smtp.rcpttodomain=amazon.com smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=PBV1jKr2SAQE6pQekdVX5hJZlX2szBTXttlcGMO2HEg=; b=GI8yqgzsuWo/HnGPx0FTKCkZ7mP5nwvyAAXoN5ymMs0FFMlM8+tM8BX54Afu1G7UfCisWZAMT0clMpuBZViIKSc9H71UhSALWkcfKdbXa7rdSuIo5kBEWkE9nWzEbnGOO5cJhdJr4q5V3JzOkKKmNyC4z/1Oql/9vR/2S/6qHrAERE6nEJ2BPKCIkMWMpkV7QqEelBUdlqhXrTMOSuzqPMkIbyp3X6s2IuqQkUN5WjLyGG7mbMvoz6RqB6iuP+l7lu94geNdacD9xx7WK6NF3Z1Fx2RscdeQGDrK2H5jR9SDKu5zINqNMNX4r46i9nZI8RAOQ/37Dc5EFnahHXyptw== Received: from MW4PR04CA0294.namprd04.prod.outlook.com (2603:10b6:303:89::29) by CH3PR12MB7618.namprd12.prod.outlook.com (2603:10b6:610:14c::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7409.46; Sat, 13 Apr 2024 13:00:45 +0000 Received: from MWH0EPF000989E9.namprd02.prod.outlook.com (2603:10b6:303:89:cafe::55) by MW4PR04CA0294.outlook.office365.com (2603:10b6:303:89::29) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7472.27 via Frontend Transport; Sat, 13 Apr 2024 13:00:45 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.117.161) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.117.161 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.117.161; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.117.161) by MWH0EPF000989E9.mail.protection.outlook.com (10.167.241.136) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7452.22 via Frontend Transport; Sat, 13 Apr 2024 13:00:45 +0000 Received: from rnnvmail201.nvidia.com (10.129.68.8) by mail.nvidia.com (10.129.200.67) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.986.41; Sat, 13 Apr 2024 06:00:24 -0700 Received: from nvidia.com (10.126.230.35) by rnnvmail201.nvidia.com (10.129.68.8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1258.12; Sat, 13 Apr 2024 06:00:22 -0700 From: Xueming Li To: Shai Brandes CC: Ferruh Yigit , dpdk stable Subject: patch 'net/ena: fix mbuf double free in fast free mode' has been queued to stable release 23.11.1 Date: Sat, 13 Apr 2024 20:49:54 +0800 Message-ID: <20240413125005.725659-114-xuemingl@nvidia.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20240413125005.725659-1-xuemingl@nvidia.com> References: <20240305094757.439387-1-xuemingl@nvidia.com> <20240413125005.725659-1-xuemingl@nvidia.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain X-Originating-IP: [10.126.230.35] X-ClientProxiedBy: rnnvmail201.nvidia.com (10.129.68.8) To rnnvmail201.nvidia.com (10.129.68.8) X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: MWH0EPF000989E9:EE_|CH3PR12MB7618:EE_ X-MS-Office365-Filtering-Correlation-Id: 409a5d62-69e6-4202-8174-08dc5bb9bb7d X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: M6ktjMHzCHxPcve3c9pzkElLJygCEBi00/Ni5g/z6Qs4qj3FkvGI2wTofnnKuNJ9nck75bEHmnvyiT0O4pMMgiEBiUQczygW//znbHO9+RFLQ6mZOfAXey7sA4NNjmDzYbJhuceJY/M8EtUrL+hOYWHnwCtkPJIAmm+S0O6T3qcahlT+276Uiw3NIm2LKo7OwXnLqA+sG1Rrd7+eMcPT3Xadk6MREhVaVfYcqfFMIvY4lMwIrGUsNKUVVB2kHImOcpq3Nd+LaabEft16gr06XVkkgooesmLwgCe/LtCXYMmfbhj60QyCXna5tkdhez1VGZ37FGgqbPIMwwfYlcA4NPHT21+mMo55vXh4Q/WDsW63yLDH4/lFUaRWtggoZkLod/7PAgXDsT3jAJ2IzgUfsJldbQU/eiI8wRSqd5T6lhTPrawwVOosUVBVvDbRaWc4EHI9srv9QWzSB/+vPLwbL+832nPN0QifaWKjf/V5ADabosFoNR39p1zgkQrinwi2o+YkLk5436VJNTmKoZMvSRj6Fr8THvRNH9rjIsPa4QNiEb7ZtBHJw7odtCIpeRpEqyESGMdVT9ZwJDkEVc3XFQNK6tPtf1RFvOHJPMH9UQFB5Eq9iwffDZ5+3HPSiZ6bYpXytkHWWQ4dq+pHiwBg94MuQM69KsvQI0CzNfTG2RqrAggX9bqTm4oVy2lc4uHYCRT9GhAg6UGfgQiDvC61ukLgCk8ZN3c+E/0NKW/0BP2FnZNtYfTCJIgIZ6DyFOFX X-Forefront-Antispam-Report: CIP:216.228.117.161; CTRY:US; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:mail.nvidia.com; PTR:dc6edge2.nvidia.com; CAT:NONE; SFS:(13230031)(1800799015)(82310400014)(376005)(36860700004); DIR:OUT; SFP:1101; X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 13 Apr 2024 13:00:45.1472 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 409a5d62-69e6-4202-8174-08dc5bb9bb7d X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a; Ip=[216.228.117.161]; Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: MWH0EPF000989E9.namprd02.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH3PR12MB7618 X-BeenThere: stable@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: patches for DPDK stable branches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: stable-bounces@dpdk.org Hi, FYI, your patch has been queued to stable release 23.11.1 Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet. It will be pushed if I get no objections before 04/15/24. So please shout if anyone has objections. Also note that after the patch there's a diff of the upstream commit vs the patch applied to the branch. This will indicate if there was any rebasing needed to apply to the stable branch. If there were code changes for rebasing (ie: not only metadata diffs), please double check that the rebase was correctly done. Queued patches are on a temporary branch at: https://git.dpdk.org/dpdk-stable/log/?h=23.11-staging This queued commit can be viewed at: https://git.dpdk.org/dpdk-stable/commit/?h=23.11-staging&id=d2d309e5cf0ea384c13c6357a4a0f2b08816214e Thanks. Xueming Li --- >From d2d309e5cf0ea384c13c6357a4a0f2b08816214e Mon Sep 17 00:00:00 2001 From: Shai Brandes Date: Wed, 20 Mar 2024 16:52:32 +0200 Subject: [PATCH] net/ena: fix mbuf double free in fast free mode Cc: Xueming Li [ upstream commit 237407f0c3dff2d0a6bbeb5f35c8b32fe5c8afed ] Fixed an issue of double free of mbufs which is exposed in mbuf fast free mode when handling multi-mbuf packets. The faulty patch mishandled free of non-head mbufs as it iterated over linked mbufs and collected them into an array, which was then passed to rte_pktmbuf_free_bulk. However, rte_pktmbuf_free_bulk already performs an internal iteration over mbufs that are linked together which led to double free. Fixes: 89b081e154c5 ("net/ena: fix fast mbuf free") Signed-off-by: Shai Brandes Acked-by: Ferruh Yigit --- drivers/net/ena/ena_ethdev.c | 39 +++++++++++------------------------- 1 file changed, 12 insertions(+), 27 deletions(-) diff --git a/drivers/net/ena/ena_ethdev.c b/drivers/net/ena/ena_ethdev.c index 1e138849cc..e122a55fa4 100644 --- a/drivers/net/ena/ena_ethdev.c +++ b/drivers/net/ena/ena_ethdev.c @@ -37,10 +37,10 @@ #define ENA_MIN_RING_DESC 128 /* - * We should try to keep ENA_CLEANUP_BUF_SIZE lower than + * We should try to keep ENA_CLEANUP_BUF_THRESH lower than * RTE_MEMPOOL_CACHE_MAX_SIZE, so we can fit this in mempool local cache. */ -#define ENA_CLEANUP_BUF_SIZE 256 +#define ENA_CLEANUP_BUF_THRESH 256 #define ENA_PTYPE_HAS_HASH (RTE_PTYPE_L4_TCP | RTE_PTYPE_L4_UDP) @@ -3105,32 +3105,12 @@ static int ena_xmit_mbuf(struct ena_ring *tx_ring, struct rte_mbuf *mbuf) return 0; } -static __rte_always_inline size_t -ena_tx_cleanup_mbuf_fast(struct rte_mbuf **mbufs_to_clean, - struct rte_mbuf *mbuf, - size_t mbuf_cnt, - size_t buf_size) -{ - struct rte_mbuf *m_next; - - while (mbuf != NULL) { - m_next = mbuf->next; - mbufs_to_clean[mbuf_cnt++] = mbuf; - if (mbuf_cnt == buf_size) { - rte_pktmbuf_free_bulk(mbufs_to_clean, mbuf_cnt); - mbuf_cnt = 0; - } - mbuf = m_next; - } - - return mbuf_cnt; -} - static int ena_tx_cleanup(void *txp, uint32_t free_pkt_cnt) { - struct rte_mbuf *mbufs_to_clean[ENA_CLEANUP_BUF_SIZE]; + struct rte_mbuf *pkts_to_clean[ENA_CLEANUP_BUF_THRESH]; struct ena_ring *tx_ring = (struct ena_ring *)txp; size_t mbuf_cnt = 0; + size_t pkt_cnt = 0; unsigned int total_tx_descs = 0; unsigned int total_tx_pkts = 0; uint16_t cleanup_budget; @@ -3161,8 +3141,13 @@ static int ena_tx_cleanup(void *txp, uint32_t free_pkt_cnt) mbuf = tx_info->mbuf; if (fast_free) { - mbuf_cnt = ena_tx_cleanup_mbuf_fast(mbufs_to_clean, mbuf, mbuf_cnt, - ENA_CLEANUP_BUF_SIZE); + pkts_to_clean[pkt_cnt++] = mbuf; + mbuf_cnt += mbuf->nb_segs; + if (mbuf_cnt >= ENA_CLEANUP_BUF_THRESH) { + rte_pktmbuf_free_bulk(pkts_to_clean, pkt_cnt); + mbuf_cnt = 0; + pkt_cnt = 0; + } } else { rte_pktmbuf_free(mbuf); } @@ -3185,7 +3170,7 @@ static int ena_tx_cleanup(void *txp, uint32_t free_pkt_cnt) } if (mbuf_cnt != 0) - rte_pktmbuf_free_bulk(mbufs_to_clean, mbuf_cnt); + rte_pktmbuf_free_bulk(pkts_to_clean, pkt_cnt); /* Notify completion handler that full cleanup was performed */ if (free_pkt_cnt == 0 || total_tx_pkts < cleanup_budget) -- 2.34.1 --- Diff of the applied patch vs upstream commit (please double-check if non-empty: --- --- - 2024-04-13 20:43:08.518477733 +0800 +++ 0114-net-ena-fix-mbuf-double-free-in-fast-free-mode.patch 2024-04-13 20:43:05.137753749 +0800 @@ -1 +1 @@ -From 237407f0c3dff2d0a6bbeb5f35c8b32fe5c8afed Mon Sep 17 00:00:00 2001 +From d2d309e5cf0ea384c13c6357a4a0f2b08816214e Mon Sep 17 00:00:00 2001 @@ -4,0 +5,3 @@ +Cc: Xueming Li + +[ upstream commit 237407f0c3dff2d0a6bbeb5f35c8b32fe5c8afed ] @@ -16 +18,0 @@ -Cc: stable@dpdk.org @@ -25 +27 @@ -index 7b697c150a..66fc287faf 100644 +index 1e138849cc..e122a55fa4 100644 @@ -28,2 +30,2 @@ -@@ -48,10 +48,10 @@ - #define MAX_WIDE_LLQ_DEPTH_UNSUPPORTED 0 +@@ -37,10 +37,10 @@ + #define ENA_MIN_RING_DESC 128 @@ -41 +43 @@ -@@ -3180,32 +3180,12 @@ static int ena_xmit_mbuf(struct ena_ring *tx_ring, struct rte_mbuf *mbuf) +@@ -3105,32 +3105,12 @@ static int ena_xmit_mbuf(struct ena_ring *tx_ring, struct rte_mbuf *mbuf) @@ -76 +78 @@ -@@ -3236,8 +3216,13 @@ static int ena_tx_cleanup(void *txp, uint32_t free_pkt_cnt) +@@ -3161,8 +3141,13 @@ static int ena_tx_cleanup(void *txp, uint32_t free_pkt_cnt) @@ -92 +94 @@ -@@ -3260,7 +3245,7 @@ static int ena_tx_cleanup(void *txp, uint32_t free_pkt_cnt) +@@ -3185,7 +3170,7 @@ static int ena_tx_cleanup(void *txp, uint32_t free_pkt_cnt)