From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id F060745E13 for ; Tue, 3 Dec 2024 07:53:20 +0100 (CET) Received: from mails.dpdk.org (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id E543340261; Tue, 3 Dec 2024 07:53:20 +0100 (CET) Received: from szxga01-in.huawei.com (szxga01-in.huawei.com [45.249.212.187]) by mails.dpdk.org (Postfix) with ESMTP id 79B5840261 for ; Tue, 3 Dec 2024 07:53:18 +0100 (CET) Received: from mail.maildlp.com (unknown [172.19.162.254]) by szxga01-in.huawei.com (SkyGuard) with ESMTP id 4Y2WWj4SGdz11PPv for ; Tue, 3 Dec 2024 14:50:57 +0800 (CST) Received: from kwepemf500004.china.huawei.com (unknown [7.202.181.242]) by mail.maildlp.com (Postfix) with ESMTPS id 6A518180101 for ; Tue, 3 Dec 2024 14:53:13 +0800 (CST) Received: from localhost.localdomain (10.90.30.45) by kwepemf500004.china.huawei.com (7.202.181.242) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Tue, 3 Dec 2024 14:53:12 +0800 From: Jie Hai To: , , Dongdong Liu , Yisen Zhuang , Huisong Li , Chengwen Feng , "Wei Hu (Xavier)" CC: Subject: [PATCH 22.11] net/hns3: fix crash for NEON and SVE Date: Tue, 3 Dec 2024 14:46:02 +0800 Message-ID: <20241203064603.217172-1-haijie1@huawei.com> X-Mailer: git-send-email 2.30.0 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain X-Originating-IP: [10.90.30.45] X-ClientProxiedBy: dggems701-chm.china.huawei.com (10.3.19.178) To kwepemf500004.china.huawei.com (7.202.181.242) X-BeenThere: stable@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: patches for DPDK stable branches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: stable-bounces@dpdk.org From: Huisong Li [ upstream commit 01843ab2f2fc8c3137258ec39b2cb6f62ba7b8a2 ] Driver may fail to allocate bulk mbufs for Neon and SVE when rearm mbuf. Currently, driver keeps going to handle packets even if there isn't available descriptors to receive packets at this moment. As a result, driver probably fills the mbufs with invalid data to application and accesses to illegal address because of the VLD bit of the descriptor at the "rx_rearm_start" position still being set. So driver has to clear VLD bit for this descriptor in this scenario in case of receiving packets later. In addition, it is possible that the sum of the "rx_rearm_nb" and "rx_rearm_start" is greater than total descriptor number of Rx queue in the above scenario. So the index of rxq->sw_ring[] to set mbuf pointer to NULL should also be fixed to avoid out-of-bounds memory access. Fixes: a3d4f4d291d7 ("net/hns3: support NEON Rx") Fixes: f81a18f49152 ("net/hns3: fix mbuf leakage when RxQ started after reset") Signed-off-by: Huisong Li --- drivers/net/hns3/hns3_rxtx.c | 2 +- drivers/net/hns3/hns3_rxtx_vec.c | 5 +++++ drivers/net/hns3/hns3_rxtx_vec_sve.c | 5 +++++ 3 files changed, 11 insertions(+), 1 deletion(-) diff --git a/drivers/net/hns3/hns3_rxtx.c b/drivers/net/hns3/hns3_rxtx.c index 16cb174f4dad..bdc162bc5c8e 100644 --- a/drivers/net/hns3/hns3_rxtx.c +++ b/drivers/net/hns3/hns3_rxtx.c @@ -51,7 +51,7 @@ hns3_rx_queue_release_mbufs(struct hns3_rx_queue *rxq) } } for (i = 0; i < rxq->rx_rearm_nb; i++) - rxq->sw_ring[rxq->rx_rearm_start + i].mbuf = NULL; + rxq->sw_ring[(rxq->rx_rearm_start + i) % rxq->nb_rx_desc].mbuf = NULL; } for (i = 0; i < rxq->bulk_mbuf_num; i++) diff --git a/drivers/net/hns3/hns3_rxtx_vec.c b/drivers/net/hns3/hns3_rxtx_vec.c index cd9264d91bbd..b6aee9af67a8 100644 --- a/drivers/net/hns3/hns3_rxtx_vec.c +++ b/drivers/net/hns3/hns3_rxtx_vec.c @@ -66,6 +66,11 @@ hns3_rxq_rearm_mbuf(struct hns3_rx_queue *rxq) if (unlikely(rte_mempool_get_bulk(rxq->mb_pool, (void *)rxep, HNS3_DEFAULT_RXQ_REARM_THRESH) < 0)) { + /* + * Clear VLD bit for the first descriptor rearmed in case + * of going to receive packets later. + */ + rxdp[0].rx.bd_base_info = 0; rte_eth_devices[rxq->port_id].data->rx_mbuf_alloc_failed++; return; } diff --git a/drivers/net/hns3/hns3_rxtx_vec_sve.c b/drivers/net/hns3/hns3_rxtx_vec_sve.c index 6f23ba674d09..2ca6a70fed6a 100644 --- a/drivers/net/hns3/hns3_rxtx_vec_sve.c +++ b/drivers/net/hns3/hns3_rxtx_vec_sve.c @@ -248,6 +248,11 @@ hns3_rxq_rearm_mbuf_sve(struct hns3_rx_queue *rxq) if (unlikely(rte_mempool_get_bulk(rxq->mb_pool, (void *)rxep, HNS3_DEFAULT_RXQ_REARM_THRESH) < 0)) { + /* + * Clear VLD bit for the first descriptor rearmed in case + * of going to receive packets later. + */ + rxdp[0].rx.bd_base_info = 0; rte_eth_devices[rxq->port_id].data->rx_mbuf_alloc_failed++; return; } -- 2.33.0