[dpdk-dev] net/mlx5: fix a segmentation fault in Rx

  Fixed issue could occur when a Mbuf starvation happens in a middle of
reception of a segmented packet, in such situation, the PMD has to release
all segments of such packet.  The end condition was wrong causing it to
free a Mbuf still handled by the NIC.

Fixes: 9964b965ad69 ("net/mlx5: re-add Rx scatter support")

Reported-by: Yongseok Koh <yskoh@mellanox.com>
Signed-off-by: Nelio Laranjeiro <nelio.laranjeiro@6wind.com>
---
 drivers/net/mlx5/mlx5_rxtx.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
  

On Fri, Jul 08, 2016 at 02:43:26PM +0200, Nelio Laranjeiro wrote:
> Fixed issue could occur when a Mbuf starvation happens in a middle of
> reception of a segmented packet, in such situation, the PMD has to release
> all segments of such packet.  The end condition was wrong causing it to
> free a Mbuf still handled by the NIC.
> 
> Fixes: 9964b965ad69 ("net/mlx5: re-add Rx scatter support")
> 
> Reported-by: Yongseok Koh <yskoh@mellanox.com>
> Signed-off-by: Nelio Laranjeiro <nelio.laranjeiro@6wind.com>
> ---
>  drivers/net/mlx5/mlx5_rxtx.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/net/mlx5/mlx5_rxtx.c b/drivers/net/mlx5/mlx5_rxtx.c
> index 0c352f3..3564937 100644
> --- a/drivers/net/mlx5/mlx5_rxtx.c
> +++ b/drivers/net/mlx5/mlx5_rxtx.c
> @@ -1572,7 +1572,8 @@ mlx5_rx_burst(void *dpdk_rxq, struct rte_mbuf **pkts, uint16_t pkts_n)
>  		rte_prefetch0(wqe);
>  		rep = rte_mbuf_raw_alloc(rxq->mp);
>  		if (unlikely(rep == NULL)) {
> -			while (pkt) {
> +			while (pkt != seg) {
> +				assert(pkt != (*rxq->elts)[idx]);
>  				seg = NEXT(pkt);
>  				rte_mbuf_refcnt_set(pkt, 0);
>  				__rte_mbuf_raw_free(pkt);
> -- 
> 2.1.4
> 

Acked-by: Adrien Mazarguil <adrien.mazarguil@6wind.com>
  

On Fri, Jul 08, 2016 at 03:29:02PM +0200, Adrien Mazarguil wrote:
> On Fri, Jul 08, 2016 at 02:43:26PM +0200, Nelio Laranjeiro wrote:
> > Fixed issue could occur when a Mbuf starvation happens in a middle of
> > reception of a segmented packet, in such situation, the PMD has to release
> > all segments of such packet.  The end condition was wrong causing it to
> > free a Mbuf still handled by the NIC.
> > 
> > Fixes: 9964b965ad69 ("net/mlx5: re-add Rx scatter support")
> > 
> > Reported-by: Yongseok Koh <yskoh@mellanox.com>
> > Signed-off-by: Nelio Laranjeiro <nelio.laranjeiro@6wind.com>
> > ---
> >  drivers/net/mlx5/mlx5_rxtx.c | 3 ++-
> >  1 file changed, 2 insertions(+), 1 deletion(-)
> > 
> > diff --git a/drivers/net/mlx5/mlx5_rxtx.c b/drivers/net/mlx5/mlx5_rxtx.c
> > index 0c352f3..3564937 100644
> > --- a/drivers/net/mlx5/mlx5_rxtx.c
> > +++ b/drivers/net/mlx5/mlx5_rxtx.c
> > @@ -1572,7 +1572,8 @@ mlx5_rx_burst(void *dpdk_rxq, struct rte_mbuf **pkts, uint16_t pkts_n)
> >  		rte_prefetch0(wqe);
> >  		rep = rte_mbuf_raw_alloc(rxq->mp);
> >  		if (unlikely(rep == NULL)) {
> > -			while (pkt) {
> > +			while (pkt != seg) {
> > +				assert(pkt != (*rxq->elts)[idx]);
> >  				seg = NEXT(pkt);
> >  				rte_mbuf_refcnt_set(pkt, 0);
> >  				__rte_mbuf_raw_free(pkt);
> > -- 
> > 2.1.4
> > 
> 
> Acked-by: Adrien Mazarguil <adrien.mazarguil@6wind.com>
> 
Applied to dpdk-next-net/rel_16_07

/Bruce