patch 'net/mlx5: workaround list management of Rx queue control' has been queued to stable release 21.11.9

[Kevin Traynor]

Hi,

FYI, your patch has been queued to stable release 21.11.9

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 12/02/24. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/kevintraynor/dpdk-stable

This queued commit can be viewed at:
https://github.com/kevintraynor/dpdk-stable/commit/c360d3ce339bfbe9cb6abf5bd04e8c5a2b769246

Thanks.

Kevin

---
>From c360d3ce339bfbe9cb6abf5bd04e8c5a2b769246 Mon Sep 17 00:00:00 2001
From: Bing Zhao <bingz at nvidia.com>
Date: Tue, 23 Jul 2024 14:14:11 +0300
Subject: [PATCH] net/mlx5: workaround list management of Rx queue control

[ upstream commit f957ac99643535fd218753f4f956fc9c5aadd23c ]

The LIST_REMOVE macro only removes the entry from the list and
updates list itself. The pointers of this entry are not reset to
NULL to prevent the accessing for the 2nd time.

In the previous fix for the memory accessing, the "rxq_ctrl" was
removed from the list in a device private data when the "refcnt" was
decreased to 0. Under only shared or non-shared queues scenarios,
this was safe since all the "rxq_ctrl" entries were freed or kept.

There is one case that shared and non-shared Rx queues are configured
simultaneously, for example, a hairpin Rx queue cannot be shared.
When closing the port that allocated the shared Rx queues'
"rxq_ctrl", if the next entry is hairpin "rxq_ctrl", the hairpin
"rxq_ctrl" will be freed directly with other resources. When trying
to close the another port sharing the "rxq_ctrl", the LIST_REMOVE
will be called again and cause some UFA issue. If the memory is no
longer mapped, there will be a SIGSEGV.

Adding a flag in the Rx queue private structure to remove the
"rxq_ctrl" from the list only on the port/queue that allocated it.

Fixes: bcc220cb57d7 ("net/mlx5: fix shared Rx queue list management")

Signed-off-by: Bing Zhao <bingz at nvidia.com>
Acked-by: Viacheslav Ovsiienko <viacheslavo at nvidia.com>
---
 drivers/net/mlx5/mlx5_rx.h  | 1 +
 drivers/net/mlx5/mlx5_rxq.c | 5 ++++-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/net/mlx5/mlx5_rx.h b/drivers/net/mlx5/mlx5_rx.h
index 5bcb6cb03a..62f6323cdc 100644
--- a/drivers/net/mlx5/mlx5_rx.h
+++ b/drivers/net/mlx5/mlx5_rx.h
@@ -175,4 +175,5 @@ struct mlx5_rxq_ctrl {
 struct mlx5_rxq_priv {
 	uint16_t idx; /* Queue index. */
+	bool possessor; /* Shared rxq_ctrl allocated for the 1st time. */
 	uint32_t refcnt; /* Reference counter. */
 	struct mlx5_rxq_ctrl *ctrl; /* Shared Rx Queue. */
diff --git a/drivers/net/mlx5/mlx5_rxq.c b/drivers/net/mlx5/mlx5_rxq.c
index da1b1f8bb9..4e958d2005 100644
--- a/drivers/net/mlx5/mlx5_rxq.c
+++ b/drivers/net/mlx5/mlx5_rxq.c
@@ -941,4 +941,5 @@ mlx5_rx_queue_setup(struct rte_eth_dev *dev, uint16_t idx, uint16_t desc,
 			return -rte_errno;
 		}
+		rxq->possessor = true;
 	}
 	mlx5_rxq_ref(dev, idx);
@@ -2013,4 +2014,5 @@ mlx5_rxq_hairpin_new(struct rte_eth_dev *dev, struct mlx5_rxq_priv *rxq,
 	tmpl->rxq.idx = idx;
 	rxq->hairpin_conf = *hairpin_conf;
+	rxq->possessor = true;
 	mlx5_rxq_ref(dev, idx);
 	LIST_INSERT_HEAD(&priv->rxqsctrl, tmpl, next);
@@ -2162,5 +2164,6 @@ mlx5_rxq_release(struct rte_eth_dev *dev, uint16_t idx)
 		}
 	} else { /* Refcnt zero, closing device. */
-		LIST_REMOVE(rxq_ctrl, next);
+		if (rxq->possessor)
+			LIST_REMOVE(rxq_ctrl, next);
 		LIST_REMOVE(rxq, owner_entry);
 		if (LIST_EMPTY(&rxq_ctrl->owners)) {
-- 
2.47.0

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2024-11-27 17:17:40.212579628 +0000
+++ 0062-net-mlx5-workaround-list-management-of-Rx-queue-cont.patch	2024-11-27 17:17:38.242269461 +0000
@@ -1 +1 @@
-From f957ac99643535fd218753f4f956fc9c5aadd23c Mon Sep 17 00:00:00 2001
+From c360d3ce339bfbe9cb6abf5bd04e8c5a2b769246 Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit f957ac99643535fd218753f4f956fc9c5aadd23c ]
+
@@ -28 +29,0 @@
-Cc: stable at dpdk.org
@@ -38 +39 @@
-index 7d144921ab..9bcb43b007 100644
+index 5bcb6cb03a..62f6323cdc 100644
@@ -41 +42 @@
-@@ -174,4 +174,5 @@ struct mlx5_rxq_ctrl {
+@@ -175,4 +175,5 @@ struct mlx5_rxq_ctrl {
@@ -45 +46 @@
- 	RTE_ATOMIC(uint32_t) refcnt; /* Reference counter. */
+ 	uint32_t refcnt; /* Reference counter. */
@@ -48 +49 @@
-index f13fc3b353..c6655b7db4 100644
+index da1b1f8bb9..4e958d2005 100644
@@ -51 +52 @@
-@@ -939,4 +939,5 @@ mlx5_rx_queue_setup(struct rte_eth_dev *dev, uint16_t idx, uint16_t desc,
+@@ -941,4 +941,5 @@ mlx5_rx_queue_setup(struct rte_eth_dev *dev, uint16_t idx, uint16_t desc,
@@ -56,2 +57,2 @@
- 	rxq->priv = priv;
-@@ -2016,4 +2017,5 @@ mlx5_rxq_hairpin_new(struct rte_eth_dev *dev, struct mlx5_rxq_priv *rxq,
+ 	mlx5_rxq_ref(dev, idx);
+@@ -2013,4 +2014,5 @@ mlx5_rxq_hairpin_new(struct rte_eth_dev *dev, struct mlx5_rxq_priv *rxq,
@@ -63 +64 @@
-@@ -2283,5 +2285,6 @@ mlx5_rxq_release(struct rte_eth_dev *dev, uint16_t idx)
+@@ -2162,5 +2164,6 @@ mlx5_rxq_release(struct rte_eth_dev *dev, uint16_t idx)