[dpdk-stable] [PATCH] net/mlx5: fix buffer leakage on Tx queue release

[dpdk-stable] [PATCH] net/mlx5: fix buffer leakage on Tx queue release

[Viacheslav Ovsiienko]

On Tx queue release the mlx5 PMD freed the mbufs stored
in the elts array (holds buffers being transmitted) only
for zero reference counter. The one reference is hold
for the queue release call. Hence, on device stop call
the reference counter was at least 2 and elts array was
not freed. If application called the device start without
queue release the elts array was cleaned up and the
remaining mbufs were lost.

Fixes: 6e78005a9b30 ("net/mlx5: add reference counter on DPDK Tx queues")

Signed-off-by: Viacheslav Ovsiienko <viacheslavo@nvidia.com>

---
This patch is applicable for 19.11LTS only (and possible for
preceeding releases), no bug in 20.11 and Upstream.

 drivers/net/mlx5/mlx5_txq.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/mlx5/mlx5_txq.c b/drivers/net/mlx5/mlx5_txq.c
index 9c929a57ea..d9576e7a64 100644
--- a/drivers/net/mlx5/mlx5_txq.c
+++ b/drivers/net/mlx5/mlx5_txq.c
@@ -1415,6 +1415,8 @@ mlx5_txq_release(struct rte_eth_dev *dev, uint16_t idx)
 	txq = container_of((*priv->txqs)[idx], struct mlx5_txq_ctrl, txq);
 	if (txq->obj && !mlx5_txq_obj_release(txq->obj))
 		txq->obj = NULL;
+	if (rte_atomic32_read(&txq->refcnt <= 2)
+		txq_free_elts(txq);
 	if (rte_atomic32_dec_and_test(&txq->refcnt)) {
 		txq_free_elts(txq);
 		mlx5_mr_btree_free(&txq->txq.mr_ctrl.cache_bh);
-- 
2.28.0

Re: [dpdk-stable] [PATCH] net/mlx5: fix buffer leakage on Tx queue release

[Kevin Traynor]

Relevant for 19.11 and 20.11 LTS

+cc Christian (19.11 LTS maintainer)

On 17/04/2021 19:38, Viacheslav Ovsiienko wrote:
> On Tx queue release the mlx5 PMD freed the mbufs stored
> in the elts array (holds buffers being transmitted) only
> for zero reference counter. The one reference is hold
> for the queue release call. Hence, on device stop call
> the reference counter was at least 2 and elts array was
> not freed. If application called the device start without
> queue release the elts array was cleaned up and the
> remaining mbufs were lost.
> 
> Fixes: 6e78005a9b30 ("net/mlx5: add reference counter on DPDK Tx queues")
> 
> Signed-off-by: Viacheslav Ovsiienko <viacheslavo@nvidia.com>
> 
> ---
> This patch is applicable for 19.11LTS only (and possible for
> preceeding releases), no bug in 20.11 and Upstream.
> 
>  drivers/net/mlx5/mlx5_txq.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/net/mlx5/mlx5_txq.c b/drivers/net/mlx5/mlx5_txq.c
> index 9c929a57ea..d9576e7a64 100644
> --- a/drivers/net/mlx5/mlx5_txq.c
> +++ b/drivers/net/mlx5/mlx5_txq.c
> @@ -1415,6 +1415,8 @@ mlx5_txq_release(struct rte_eth_dev *dev, uint16_t idx)
>  	txq = container_of((*priv->txqs)[idx], struct mlx5_txq_ctrl, txq);
>  	if (txq->obj && !mlx5_txq_obj_release(txq->obj))
>  		txq->obj = NULL;
> +	if (rte_atomic32_read(&txq->refcnt <= 2)
> +		txq_free_elts(txq);
>  	if (rte_atomic32_dec_and_test(&txq->refcnt)) {
>  		txq_free_elts(txq);
>  		mlx5_mr_btree_free(&txq->txq.mr_ctrl.cache_bh);
>