65 lines
2.4 KiB
Diff
65 lines
2.4 KiB
Diff
|
From 090826e4646db4a438336c5e9e879f2fa5a6e07a Mon Sep 17 00:00:00 2001
|
||
|
|
From: Huisong Li <lihuisong@huawei.com>
|
||
|
|
Date: Fri, 27 Oct 2023 14:09:41 +0800
|
||
|
|
Subject: [PATCH 371/394] net/hns3: fix crash for NEON and SVE
|
||
|
|
|
||
|
|
[ upstream commit 01843ab2f2fc8c3137258ec39b2cb6f62ba7b8a2 ]
|
||
|
|
|
||
|
|
Driver may fail to allocate bulk mbufs for Neon and SVE when rearm
|
||
|
|
mbuf. Currently, driver keeps going to handle packets even if there
|
||
|
|
isn't available descriptors to receive packets at this moment.
|
||
|
|
As a result, driver probably fills the mbufs with invalid data to
|
||
|
|
application and accesses to illegal address because of the VLD bit
|
||
|
|
of the descriptor at the "rx_rearm_start" position still being set.
|
||
|
|
So driver has to clear VLD bit for this descriptor in this scenario
|
||
|
|
in case of receiving packets later.
|
||
|
|
|
||
|
|
In addition, it is possible that the sum of the "rx_rearm_nb" and
|
||
|
|
"rx_rearm_start" is greater than total descriptor number of Rx queue
|
||
|
|
in the above scenario. So the index of rxq->sw_ring[] to set mbuf
|
||
|
|
pointer to NULL should also be fixed to avoid out-of-bounds memory
|
||
|
|
access.
|
||
|
|
|
||
|
|
Fixes: a3d4f4d291d7 ("net/hns3: support NEON Rx")
|
||
|
|
Fixes: f81a18f49152 ("net/hns3: fix mbuf leakage when RxQ started after reset")
|
||
|
|
Cc: stable@dpdk.org
|
||
|
|
|
||
|
|
Signed-off-by: Huisong Li <lihuisong@huawei.com>
|
||
|
|
---
|
||
|
|
drivers/net/hns3/hns3_rxtx.c | 2 +-
|
||
|
|
drivers/net/hns3/hns3_rxtx_vec.h | 5 +++++
|
||
|
|
2 files changed, 6 insertions(+), 1 deletion(-)
|
||
|
|
|
||
|
|
diff --git a/drivers/net/hns3/hns3_rxtx.c b/drivers/net/hns3/hns3_rxtx.c
|
||
|
|
index 208c725cd5..3054d24080 100644
|
||
|
|
--- a/drivers/net/hns3/hns3_rxtx.c
|
||
|
|
+++ b/drivers/net/hns3/hns3_rxtx.c
|
||
|
|
@@ -51,7 +51,7 @@ hns3_rx_queue_release_mbufs(struct hns3_rx_queue *rxq)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
for (i = 0; i < rxq->rx_rearm_nb; i++)
|
||
|
|
- rxq->sw_ring[rxq->rx_rearm_start + i].mbuf = NULL;
|
||
|
|
+ rxq->sw_ring[(rxq->rx_rearm_start + i) % rxq->nb_rx_desc].mbuf = NULL;
|
||
|
|
}
|
||
|
|
|
||
|
|
for (i = 0; i < rxq->bulk_mbuf_num; i++)
|
||
|
|
diff --git a/drivers/net/hns3/hns3_rxtx_vec.h b/drivers/net/hns3/hns3_rxtx_vec.h
|
||
|
|
index a9a6774294..9018e79c2f 100644
|
||
|
|
--- a/drivers/net/hns3/hns3_rxtx_vec.h
|
||
|
|
+++ b/drivers/net/hns3/hns3_rxtx_vec.h
|
||
|
|
@@ -106,6 +106,11 @@ hns3_rxq_rearm_mbuf(struct hns3_rx_queue *rxq)
|
||
|
|
|
||
|
|
if (unlikely(rte_mempool_get_bulk(rxq->mb_pool, (void *)rxep,
|
||
|
|
HNS3_DEFAULT_RXQ_REARM_THRESH) < 0)) {
|
||
|
|
+ /*
|
||
|
|
+ * Clear VLD bit for the first descriptor rearmed in case
|
||
|
|
+ * of going to receive packets later.
|
||
|
|
+ */
|
||
|
|
+ rxdp[0].rx.bd_base_info = 0;
|
||
|
|
rte_eth_devices[rxq->port_id].data->rx_mbuf_alloc_failed++;
|
||
|
|
return;
|
||
|
|
}
|
||
|
|
--
|
||
|
|
2.23.0
|
||
|
|
|