d/numam-dpdk
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

net/sfc: fix double-free in EF10 ESSB Rx queue purge

Browse Source 
Number of buffers left in completed descriptor may be 0. If so,
all buffers of the descriptor are freed once again.

Fixes: 390f9b8d82 ("net/sfc: support equal stride super-buffer Rx mode")
Cc: stable@dpdk.org

Signed-off-by: Andrew Rybchenko <arybchenko@solarflare.com>
Reviewed-by: Ivan Malov <ivan.malov@oktetlabs.ru>
This commit is contained in:
Andrew Rybchenko 2018-06-29 16:41:06 +01:00 committed by Ferruh Yigit
parent aeeb5571ee
commit 20680dae46
1 changed files with 6 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
drivers/net/sfc/sfc_ef10_essb_rx.c
View File

@ -654,29 +654,20 @@ static void
sfc_ef10_essb_rx_qpurge(struct sfc_dp_rxq *dp_rxq)
{
struct sfc_ef10_essb_rxq *rxq = sfc_ef10_essb_rxq_by_dp_rxq(dp_rxq);
unsigned int i, j;
unsigned int i;
const struct sfc_ef10_essb_rx_sw_desc *rxd;
struct rte_mbuf *m;
if (rxq->completed != rxq->added && rxq->left_in_completed > 0) {
rxd = &rxq->sw_ring[rxq->completed & rxq->rxq_ptr_mask];
m = sfc_ef10_essb_mbuf_by_index(rxq, rxd->first_mbuf,
rxq->block_size - rxq->left_in_completed);
do {
rxq->left_in_completed--;
rte_mempool_put(rxq->refill_mb_pool, m);
m = sfc_ef10_essb_next_mbuf(rxq, m);
} while (rxq->left_in_completed > 0);
rxq->completed++;
}
for (i = rxq->completed; i != rxq->added; ++i) {
rxd = &rxq->sw_ring[i & rxq->rxq_ptr_mask];
m = rxd->first_mbuf;
for (j = 0; j < rxq->block_size; ++j) {
m = sfc_ef10_essb_mbuf_by_index(rxq, rxd->first_mbuf,
rxq->block_size - rxq->left_in_completed);
while (rxq->left_in_completed > 0) {
rte_mempool_put(rxq->refill_mb_pool, m);
m = sfc_ef10_essb_next_mbuf(rxq, m);
rxq->left_in_completed--;
}
rxq->left_in_completed = rxq->block_size;
}
rxq->flags &= ~SFC_EF10_ESSB_RXQ_STARTED;