diff mbox

[dpdk-dev] net/i40e: fix null pointer dereferences when using VMDQ+RSS

Message ID 1470166496-70610-1-git-send-email-rich.lane@bigswitch.com (mailing list archive)
State Accepted, archived
Delegated to: Bruce Richardson
Headers

Commit Message

Rich Lane Aug. 2, 2016, 7:34 p.m. UTC 
  When using VMDQ+RSS, the queue ids used by the application are not
contiguous (see i40e_pf_config_rss). Most of the driver already handled
this, but there were a few cases where it assumed all configured queues
had been setup.

Fixes: 4861cde46116 ("i40e: new poll mode driver")
Fixes: 6b4537128394 ("i40e: free queue memory when closing")
Fixes: 8e109464c022 ("i40e: allow vector Rx and Tx usage")

Signed-off-by: Rich Lane <rich.lane@bigswitch.com>
---
 drivers/net/i40e/i40e_rxtx.c | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

Comments

Ferruh Yigit Sept. 14, 2016, 2 p.m. UTC | #1 
On 8/2/2016 8:34 PM, Rich Lane wrote:
> When using VMDQ+RSS, the queue ids used by the application are not
> contiguous (see i40e_pf_config_rss). Most of the driver already handled
> this, but there were a few cases where it assumed all configured queues
> had been setup.
> 
> Fixes: 4861cde46116 ("i40e: new poll mode driver")
> Fixes: 6b4537128394 ("i40e: free queue memory when closing")
> Fixes: 8e109464c022 ("i40e: allow vector Rx and Tx usage")
> 
> Signed-off-by: Rich Lane <rich.lane@bigswitch.com>
> ---
>  drivers/net/i40e/i40e_rxtx.c | 15 ++++++++++++---
>  1 file changed, 12 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/net/i40e/i40e_rxtx.c b/drivers/net/i40e/i40e_rxtx.c
> index 554d167..0556a4d 100644
> --- a/drivers/net/i40e/i40e_rxtx.c
> +++ b/drivers/net/i40e/i40e_rxtx.c
> @@ -2948,11 +2948,15 @@ i40e_dev_clear_queues(struct rte_eth_dev *dev)
>  	PMD_INIT_FUNC_TRACE();
>  
>  	for (i = 0; i < dev->data->nb_tx_queues; i++) {
> +		if (!dev->data->tx_queues[i])
> +			continue;
>  		i40e_tx_queue_release_mbufs(dev->data->tx_queues[i]);
>  		i40e_reset_tx_queue(dev->data->tx_queues[i]);
>  	}
>  
>  	for (i = 0; i < dev->data->nb_rx_queues; i++) {
> +		if (!dev->data->rx_queues[i])
> +			continue;
>  		i40e_rx_queue_release_mbufs(dev->data->rx_queues[i]);
>  		i40e_reset_rx_queue(dev->data->rx_queues[i]);
>  	}
> @@ -2966,12 +2970,16 @@ i40e_dev_free_queues(struct rte_eth_dev *dev)
>  	PMD_INIT_FUNC_TRACE();
>  
>  	for (i = 0; i < dev->data->nb_rx_queues; i++) {
> +		if (!dev->data->rx_queues[i])
> +			continue;
>  		i40e_dev_rx_queue_release(dev->data->rx_queues[i]);
>  		dev->data->rx_queues[i] = NULL;
>  	}
>  	dev->data->nb_rx_queues = 0;
>  
>  	for (i = 0; i < dev->data->nb_tx_queues; i++) {
> +		if (!dev->data->tx_queues[i])
> +			continue;
>  		i40e_dev_tx_queue_release(dev->data->tx_queues[i]);
>  		dev->data->tx_queues[i] = NULL;
>  	}
> @@ -3154,7 +3162,7 @@ i40e_set_rx_function(struct rte_eth_dev *dev)
>  				struct i40e_rx_queue *rxq =
>  					dev->data->rx_queues[i];
>  
> -				if (i40e_rxq_vec_setup(rxq)) {
> +				if (rxq && i40e_rxq_vec_setup(rxq)) {
>  					ad->rx_vec_allowed = false;
>  					break;
>  				}
> @@ -3216,7 +3224,8 @@ i40e_set_rx_function(struct rte_eth_dev *dev)
>  		for (i = 0; i < dev->data->nb_rx_queues; i++) {
>  			struct i40e_rx_queue *rxq = dev->data->rx_queues[i];
>  
> -			rxq->rx_using_sse = rx_using_sse;
> +			if (rxq)
> +				rxq->rx_using_sse = rx_using_sse;
>  		}
>  	}
>  }
> @@ -3255,7 +3264,7 @@ i40e_set_tx_function(struct rte_eth_dev *dev)
>  				struct i40e_tx_queue *txq =
>  					dev->data->tx_queues[i];
>  
> -				if (i40e_txq_vec_setup(txq)) {
> +				if (txq && i40e_txq_vec_setup(txq)) {
>  					ad->tx_vec_allowed = false;
>  					break;
>  				}
> 

i40e maintainers, can you please review the patch?

Thanks,
ferruh
Jingjing Wu Sept. 22, 2016, 8:20 a.m. UTC | #2 
> -----Original Message-----
> From: Yigit, Ferruh
> Sent: Wednesday, September 14, 2016 10:00 PM
> To: Rich Lane; dev@dpdk.org
> Cc: Zhang, Helin; Wu, Jingjing
> Subject: Re: [dpdk-dev] [PATCH] net/i40e: fix null pointer dereferences
> when using VMDQ+RSS
> 
> On 8/2/2016 8:34 PM, Rich Lane wrote:
> > When using VMDQ+RSS, the queue ids used by the application are not
> > contiguous (see i40e_pf_config_rss). Most of the driver already
> > handled this, but there were a few cases where it assumed all
> > configured queues had been setup.
> >
> > Fixes: 4861cde46116 ("i40e: new poll mode driver")
> > Fixes: 6b4537128394 ("i40e: free queue memory when closing")
> > Fixes: 8e109464c022 ("i40e: allow vector Rx and Tx usage")
> >
> > Signed-off-by: Rich Lane <rich.lane@bigswitch.com>

Acked-by: Jingjing Wu <jingjing.wu@intel.com>


> i40e maintainers, can you please review the patch?
> 
> Thanks,
> ferruh
Bruce Richardson Sept. 23, 2016, 10:56 a.m. UTC | #3 
On Thu, Sep 22, 2016 at 08:20:25AM +0000, Wu, Jingjing wrote:
> 
> 
> > -----Original Message-----
> > From: Yigit, Ferruh
> > Sent: Wednesday, September 14, 2016 10:00 PM
> > To: Rich Lane; dev@dpdk.org
> > Cc: Zhang, Helin; Wu, Jingjing
> > Subject: Re: [dpdk-dev] [PATCH] net/i40e: fix null pointer dereferences
> > when using VMDQ+RSS
> > 
> > On 8/2/2016 8:34 PM, Rich Lane wrote:
> > > When using VMDQ+RSS, the queue ids used by the application are not
> > > contiguous (see i40e_pf_config_rss). Most of the driver already
> > > handled this, but there were a few cases where it assumed all
> > > configured queues had been setup.
> > >
> > > Fixes: 4861cde46116 ("i40e: new poll mode driver")
> > > Fixes: 6b4537128394 ("i40e: free queue memory when closing")
> > > Fixes: 8e109464c022 ("i40e: allow vector Rx and Tx usage")
> > >
> > > Signed-off-by: Rich Lane <rich.lane@bigswitch.com>
> 
> Acked-by: Jingjing Wu <jingjing.wu@intel.com>
> 
>
Applied to dpdk-next-net/rel_16_11

/Bruce
diff mbox

Patch

diff --git a/drivers/net/i40e/i40e_rxtx.c b/drivers/net/i40e/i40e_rxtx.c
index 554d167..0556a4d 100644
--- a/drivers/net/i40e/i40e_rxtx.c
+++ b/drivers/net/i40e/i40e_rxtx.c
@@ -2948,11 +2948,15 @@  i40e_dev_clear_queues(struct rte_eth_dev *dev)
 	PMD_INIT_FUNC_TRACE();
 
 	for (i = 0; i < dev->data->nb_tx_queues; i++) {
+		if (!dev->data->tx_queues[i])
+			continue;
 		i40e_tx_queue_release_mbufs(dev->data->tx_queues[i]);
 		i40e_reset_tx_queue(dev->data->tx_queues[i]);
 	}
 
 	for (i = 0; i < dev->data->nb_rx_queues; i++) {
+		if (!dev->data->rx_queues[i])
+			continue;
 		i40e_rx_queue_release_mbufs(dev->data->rx_queues[i]);
 		i40e_reset_rx_queue(dev->data->rx_queues[i]);
 	}
@@ -2966,12 +2970,16 @@  i40e_dev_free_queues(struct rte_eth_dev *dev)
 	PMD_INIT_FUNC_TRACE();
 
 	for (i = 0; i < dev->data->nb_rx_queues; i++) {
+		if (!dev->data->rx_queues[i])
+			continue;
 		i40e_dev_rx_queue_release(dev->data->rx_queues[i]);
 		dev->data->rx_queues[i] = NULL;
 	}
 	dev->data->nb_rx_queues = 0;
 
 	for (i = 0; i < dev->data->nb_tx_queues; i++) {
+		if (!dev->data->tx_queues[i])
+			continue;
 		i40e_dev_tx_queue_release(dev->data->tx_queues[i]);
 		dev->data->tx_queues[i] = NULL;
 	}
@@ -3154,7 +3162,7 @@  i40e_set_rx_function(struct rte_eth_dev *dev)
 				struct i40e_rx_queue *rxq =
 					dev->data->rx_queues[i];
 
-				if (i40e_rxq_vec_setup(rxq)) {
+				if (rxq && i40e_rxq_vec_setup(rxq)) {
 					ad->rx_vec_allowed = false;
 					break;
 				}
@@ -3216,7 +3224,8 @@  i40e_set_rx_function(struct rte_eth_dev *dev)
 		for (i = 0; i < dev->data->nb_rx_queues; i++) {
 			struct i40e_rx_queue *rxq = dev->data->rx_queues[i];
 
-			rxq->rx_using_sse = rx_using_sse;
+			if (rxq)
+				rxq->rx_using_sse = rx_using_sse;
 		}
 	}
 }
@@ -3255,7 +3264,7 @@  i40e_set_tx_function(struct rte_eth_dev *dev)
 				struct i40e_tx_queue *txq =
 					dev->data->tx_queues[i];
 
-				if (i40e_txq_vec_setup(txq)) {
+				if (txq && i40e_txq_vec_setup(txq)) {
 					ad->tx_vec_allowed = false;
 					break;
 				}