[PATCH 1/3] net/nfp: fix wrong increment of free list counter

[PATCH 1/3] net/nfp: fix wrong increment of free list counter

[Chaoyong He]

When receiving a packet that is larger than the mbuf size, the Rx
function will break the receive loop and sent a free list descriptor
with random DMA address.

Fix this by moving the increment of the free list descriptor counter
to after the packet size have been checked and acted on.

Fixes: bb340f56fcb7 ("net/nfp: fix memory leak in Rx")
Cc: long.wu@corigine.com
Cc: stable@dpdk.org

Signed-off-by: Chaoyong He <chaoyong.he@corigine.com>
Reviewed-by: Niklas Söderlund <niklas.soderlund@corigine.com>
---
 drivers/net/nfp/nfp_rxtx.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/net/nfp/nfp_rxtx.c b/drivers/net/nfp/nfp_rxtx.c
index b8c874d315..38377ca218 100644
--- a/drivers/net/nfp/nfp_rxtx.c
+++ b/drivers/net/nfp/nfp_rxtx.c
@@ -293,8 +293,6 @@ nfp_net_recv_pkts(void *rx_queue, struct rte_mbuf **rx_pkts, uint16_t nb_pkts)
 			break;
 		}
 
-		nb_hold++;
-
 		/*
 		 * Grab the mbuf and refill the descriptor with the
 		 * previously allocated mbuf
@@ -365,6 +363,7 @@ nfp_net_recv_pkts(void *rx_queue, struct rte_mbuf **rx_pkts, uint16_t nb_pkts)
 		rxds->fld.dd = 0;
 		rxds->fld.dma_addr_hi = (dma_addr >> 32) & 0xff;
 		rxds->fld.dma_addr_lo = dma_addr & 0xffffffff;
+		nb_hold++;
 
 		rxq->rd_p++;
 		if (unlikely(rxq->rd_p == rxq->rx_count)) /* wrapping?*/
-- 
2.29.3

Re: [PATCH 1/3] net/nfp: fix wrong increment of free list counter

[Ferruh Yigit]

On 11/18/2022 1:44 AM, Chaoyong He wrote:
> When receiving a packet that is larger than the mbuf size, the Rx
> function will break the receive loop and sent a free list descriptor
> with random DMA address.
> 
> Fix this by moving the increment of the free list descriptor counter
> to after the packet size have been checked and acted on.
> 

Issue seems one of the Rx descriptor is not rearmed properly and may
have random DMA address, which can lead HW to DMA this random address,
so implications can be dangerous.

I suggest updating patch title slightly to highlight the impact:
"net/nfp: fix Rx descriptor DMA address"

> Fixes: bb340f56fcb7 ("net/nfp: fix memory leak in Rx")
> Cc: long.wu@corigine.com
> Cc: stable@dpdk.org
> 
> Signed-off-by: Chaoyong He <chaoyong.he@corigine.com>
> Reviewed-by: Niklas Söderlund <niklas.soderlund@corigine.com>

Series applied to dpdk-next-net/main, thanks.