[dpdk-stable] patch 'net/e1000: fix crash on Tx done clean up' has been queued to stable release 19.11.4
luca.boccassi at gmail.com
luca.boccassi at gmail.com
Fri Jul 24 14:00:08 CEST 2020
Hi,
FYI, your patch has been queued to stable release 19.11.4
Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 07/26/20. So please
shout if anyone has objections.
Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.
Thanks.
Luca Boccassi
---
>From 560396caddb52bd6ea7996a95ab3523d68e8f1dd Mon Sep 17 00:00:00 2001
From: Jeff Guo <jia.guo at intel.com>
Date: Thu, 16 Jul 2020 17:24:38 +0800
Subject: [PATCH] net/e1000: fix crash on Tx done clean up
[ upstream commit 4237be2b9e250d431d465b81a0abbe5fb559d2c8 ]
As tx mbuf is not set for some advanced descriptors, if there is no
mbuf checking before rte_pktmbuf_free_seg() function be called on
the process of tx done clean up, that will cause a segfault. So add
a NULL pointer check to fix it.
Bugzilla ID: 501
Fixes: 8d907d2b79f7 ("net/igb: free consumed Tx buffers on demand")
Signed-off-by: Jeff Guo <jia.guo at intel.com>
Reviewed-by: Wei Zhao <wei.zhao1 at intel.com>
---
drivers/net/e1000/igb_rxtx.c | 188 +++++++++++++++++------------------
1 file changed, 91 insertions(+), 97 deletions(-)
diff --git a/drivers/net/e1000/igb_rxtx.c b/drivers/net/e1000/igb_rxtx.c
index 92576b0af..5260bbe34 100644
--- a/drivers/net/e1000/igb_rxtx.c
+++ b/drivers/net/e1000/igb_rxtx.c
@@ -1295,113 +1295,107 @@ igb_tx_done_cleanup(struct igb_tx_queue *txq, uint32_t free_cnt)
uint16_t tx_id; /* Current segment being processed. */
uint16_t tx_last; /* Last segment in the current packet. */
uint16_t tx_next; /* First segment of the next packet. */
- int count;
-
- if (txq != NULL) {
- count = 0;
- sw_ring = txq->sw_ring;
- txr = txq->tx_ring;
-
- /*
- * tx_tail is the last sent packet on the sw_ring. Goto the end
- * of that packet (the last segment in the packet chain) and
- * then the next segment will be the start of the oldest segment
- * in the sw_ring. This is the first packet that will be
- * attempted to be freed.
- */
-
- /* Get last segment in most recently added packet. */
- tx_first = sw_ring[txq->tx_tail].last_id;
-
- /* Get the next segment, which is the oldest segment in ring. */
- tx_first = sw_ring[tx_first].next_id;
-
- /* Set the current index to the first. */
- tx_id = tx_first;
-
- /*
- * Loop through each packet. For each packet, verify that an
- * mbuf exists and that the last segment is free. If so, free
- * it and move on.
- */
- while (1) {
- tx_last = sw_ring[tx_id].last_id;
-
- if (sw_ring[tx_last].mbuf) {
- if (txr[tx_last].wb.status &
- E1000_TXD_STAT_DD) {
- /*
- * Increment the number of packets
- * freed.
- */
- count++;
-
- /* Get the start of the next packet. */
- tx_next = sw_ring[tx_last].next_id;
-
- /*
- * Loop through all segments in a
- * packet.
- */
- do {
- rte_pktmbuf_free_seg(sw_ring[tx_id].mbuf);
+ int count = 0;
+
+ if (!txq)
+ return -ENODEV;
+
+ sw_ring = txq->sw_ring;
+ txr = txq->tx_ring;
+
+ /* tx_tail is the last sent packet on the sw_ring. Goto the end
+ * of that packet (the last segment in the packet chain) and
+ * then the next segment will be the start of the oldest segment
+ * in the sw_ring. This is the first packet that will be
+ * attempted to be freed.
+ */
+
+ /* Get last segment in most recently added packet. */
+ tx_first = sw_ring[txq->tx_tail].last_id;
+
+ /* Get the next segment, which is the oldest segment in ring. */
+ tx_first = sw_ring[tx_first].next_id;
+
+ /* Set the current index to the first. */
+ tx_id = tx_first;
+
+ /* Loop through each packet. For each packet, verify that an
+ * mbuf exists and that the last segment is free. If so, free
+ * it and move on.
+ */
+ while (1) {
+ tx_last = sw_ring[tx_id].last_id;
+
+ if (sw_ring[tx_last].mbuf) {
+ if (txr[tx_last].wb.status &
+ E1000_TXD_STAT_DD) {
+ /* Increment the number of packets
+ * freed.
+ */
+ count++;
+
+ /* Get the start of the next packet. */
+ tx_next = sw_ring[tx_last].next_id;
+
+ /* Loop through all segments in a
+ * packet.
+ */
+ do {
+ if (sw_ring[tx_id].mbuf) {
+ rte_pktmbuf_free_seg(
+ sw_ring[tx_id].mbuf);
sw_ring[tx_id].mbuf = NULL;
sw_ring[tx_id].last_id = tx_id;
+ }
- /* Move to next segemnt. */
- tx_id = sw_ring[tx_id].next_id;
-
- } while (tx_id != tx_next);
-
- if (unlikely(count == (int)free_cnt))
- break;
- } else
- /*
- * mbuf still in use, nothing left to
- * free.
- */
- break;
- } else {
- /*
- * There are multiple reasons to be here:
- * 1) All the packets on the ring have been
- * freed - tx_id is equal to tx_first
- * and some packets have been freed.
- * - Done, exit
- * 2) Interfaces has not sent a rings worth of
- * packets yet, so the segment after tail is
- * still empty. Or a previous call to this
- * function freed some of the segments but
- * not all so there is a hole in the list.
- * Hopefully this is a rare case.
- * - Walk the list and find the next mbuf. If
- * there isn't one, then done.
- */
- if (likely((tx_id == tx_first) && (count != 0)))
- break;
-
- /*
- * Walk the list and find the next mbuf, if any.
- */
- do {
/* Move to next segemnt. */
tx_id = sw_ring[tx_id].next_id;
- if (sw_ring[tx_id].mbuf)
- break;
+ } while (tx_id != tx_next);
- } while (tx_id != tx_first);
-
- /*
- * Determine why previous loop bailed. If there
- * is not an mbuf, done.
+ if (unlikely(count == (int)free_cnt))
+ break;
+ } else {
+ /* mbuf still in use, nothing left to
+ * free.
*/
- if (sw_ring[tx_id].mbuf == NULL)
- break;
+ break;
}
+ } else {
+ /* There are multiple reasons to be here:
+ * 1) All the packets on the ring have been
+ * freed - tx_id is equal to tx_first
+ * and some packets have been freed.
+ * - Done, exit
+ * 2) Interfaces has not sent a rings worth of
+ * packets yet, so the segment after tail is
+ * still empty. Or a previous call to this
+ * function freed some of the segments but
+ * not all so there is a hole in the list.
+ * Hopefully this is a rare case.
+ * - Walk the list and find the next mbuf. If
+ * there isn't one, then done.
+ */
+ if (likely(tx_id == tx_first && count != 0))
+ break;
+
+ /* Walk the list and find the next mbuf, if any. */
+ do {
+ /* Move to next segemnt. */
+ tx_id = sw_ring[tx_id].next_id;
+
+ if (sw_ring[tx_id].mbuf)
+ break;
+
+ } while (tx_id != tx_first);
+
+ /* Determine why previous loop bailed. If there
+ * is not an mbuf, done.
+ */
+ if (!sw_ring[tx_id].mbuf)
+ break;
}
- } else
- count = -ENODEV;
+ }
return count;
}
--
2.20.1
---
Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- - 2020-07-24 12:53:55.111535714 +0100
+++ 0170-net-e1000-fix-crash-on-Tx-done-clean-up.patch 2020-07-24 12:53:48.571011751 +0100
@@ -1,8 +1,10 @@
-From 4237be2b9e250d431d465b81a0abbe5fb559d2c8 Mon Sep 17 00:00:00 2001
+From 560396caddb52bd6ea7996a95ab3523d68e8f1dd Mon Sep 17 00:00:00 2001
From: Jeff Guo <jia.guo at intel.com>
Date: Thu, 16 Jul 2020 17:24:38 +0800
Subject: [PATCH] net/e1000: fix crash on Tx done clean up
+[ upstream commit 4237be2b9e250d431d465b81a0abbe5fb559d2c8 ]
+
As tx mbuf is not set for some advanced descriptors, if there is no
mbuf checking before rte_pktmbuf_free_seg() function be called on
the process of tx done clean up, that will cause a segfault. So add
@@ -10,7 +12,6 @@
Bugzilla ID: 501
Fixes: 8d907d2b79f7 ("net/igb: free consumed Tx buffers on demand")
-Cc: stable at dpdk.org
Signed-off-by: Jeff Guo <jia.guo at intel.com>
Reviewed-by: Wei Zhao <wei.zhao1 at intel.com>
@@ -19,7 +20,7 @@
1 file changed, 91 insertions(+), 97 deletions(-)
diff --git a/drivers/net/e1000/igb_rxtx.c b/drivers/net/e1000/igb_rxtx.c
-index 6411924e0..dd520cd82 100644
+index 92576b0af..5260bbe34 100644
--- a/drivers/net/e1000/igb_rxtx.c
+++ b/drivers/net/e1000/igb_rxtx.c
@@ -1295,113 +1295,107 @@ igb_tx_done_cleanup(struct igb_tx_queue *txq, uint32_t free_cnt)
More information about the stable
mailing list