Skip to content

Commit

Permalink
net/enic: fix crash when freeing 0 packet to mempool
Browse files Browse the repository at this point in the history
Occasionally, the amount of packets to free from the work queue ends
perfectly on a boundary to have nb_free = 0 and pool = 0.  This causes
a segfault as follows:

  (gdb) bt
  #0  rte_mempool_default_cache
  #1  rte_mempool_put_bulk (n=0, obj_table=0x7f10deff2530, mp=0x0)
  #2  enic_free_wq_bufs (wq=wq@entry=0x7efabffcd5b0,
      completed_index=completed_index@entry=33)
  #3  0x00007f11e9c86e17 in enic_cleanup_wq (enic=<optimized out>,
      wq=wq@entry=0x7efabffcd5b0)
      at /usr/src/debug/openvswitch-2.6.1/dpdk-16.11/drivers/net/enic/enic_rxtx.c:442
  #4  0x00007f11e9c86e5f in enic_xmit_pkts (tx_queue=0x7efabffcd5b0,
      tx_pkts=0x7f10deffb1a8, nb_pkts=<optimized out>)
      at /usr/src/debug/openvswitch-2.6.1/dpdk-16.11/drivers/net/enic/enic_rxtx.c:470
  #5  0x00007f11e9e147ad in rte_eth_tx_burst (nb_pkts=<optimized out>,
      tx_pkts=0x7f10deffb1a8, queue_id=0, port_id=<optimized out>)

This commit makes the enic wq driver match other drivers who call the
bulk free, by checking that there are actual packets to free.

Fixes: 36935af ("net/enic: refactor Tx mbuf recycling")
CC: [email protected]

Reported-by: Vincent S. Cojot <[email protected]>
Reported-at: https://bugzilla.redhat.com/show_bug.cgi?id=1468631
Signed-off-by: Aaron Conole <[email protected]>
Reviewed-by: John Daley <[email protected]>
  • Loading branch information
apconole authored and tmonjalo committed Aug 3, 2017
1 parent 1ff8e79 commit f7a58af
Showing 1 changed file with 2 additions and 1 deletion.
3 changes: 2 additions & 1 deletion drivers/net/enic/enic_rxtx.c
Original file line number Diff line number Diff line change
Expand Up @@ -503,7 +503,8 @@ static inline void enic_free_wq_bufs(struct vnic_wq *wq, u16 completed_index)
tail_idx = enic_ring_incr(desc_count, tail_idx);
}

rte_mempool_put_bulk(pool, (void **)free, nb_free);
if (nb_free > 0)
rte_mempool_put_bulk(pool, (void **)free, nb_free);

wq->tail_idx = tail_idx;
wq->ring.desc_avail += nb_to_free;
Expand Down

0 comments on commit f7a58af

Please sign in to comment.