Message ID | 1460468967-9206-1-git-send-email-christian.ehrhardt@canonical.com (mailing list archive) |
---|---|
State | Accepted, archived |
Delegated to: | Thomas Monjalon |
Headers |
Return-Path: <dev-bounces@dpdk.org> X-Original-To: patchwork@dpdk.org Delivered-To: patchwork@dpdk.org Received: from [92.243.14.124] (localhost [IPv6:::1]) by dpdk.org (Postfix) with ESMTP id 0876E2BE6; Tue, 12 Apr 2016 15:49:27 +0200 (CEST) Received: from youngberry.canonical.com (youngberry.canonical.com [91.189.89.112]) by dpdk.org (Postfix) with ESMTP id 17DD72965 for <dev@dpdk.org>; Tue, 12 Apr 2016 15:49:26 +0200 (CEST) Received: from 1.general.mandel.uk.vpn ([10.172.196.172] helo=localhost.localdomain) by youngberry.canonical.com with esmtpsa (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.76) (envelope-from <christian.ehrhardt@canonical.com>) id 1apyh2-0001fp-Gj; Tue, 12 Apr 2016 13:49:24 +0000 From: Christian Ehrhardt <christian.ehrhardt@canonical.com> To: christian.ehrhardt@canonical.com, bruce.richardson@intel.com, dev@dpdk.org, olivier.matz@6wind.com Date: Tue, 12 Apr 2016 15:49:27 +0200 Message-Id: <1460468967-9206-1-git-send-email-christian.ehrhardt@canonical.com> X-Mailer: git-send-email 2.7.4 Subject: [dpdk-dev] [PATCH] lpm: fix freeing of rules_tbl in rte_lpm_free_v20 X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: patches and discussions about DPDK <dev.dpdk.org> List-Unsubscribe: <http://dpdk.org/ml/options/dev>, <mailto:dev-request@dpdk.org?subject=unsubscribe> List-Archive: <http://dpdk.org/ml/archives/dev/> List-Post: <mailto:dev@dpdk.org> List-Help: <mailto:dev-request@dpdk.org?subject=help> List-Subscribe: <http://dpdk.org/ml/listinfo/dev>, <mailto:dev-request@dpdk.org?subject=subscribe> Errors-To: dev-bounces@dpdk.org Sender: "dev" <dev-bounces@dpdk.org> |
Commit Message
Christian Ehrhardt
April 12, 2016, 1:49 p.m. UTC
Back then when we fixed the missing free lpm I was to quickly to say yes
if it applies not only to the lpm6 but also to all of the lpm code.
It turned out to not apply to all of them. In rte_lpm_create_v20 there
is an unexpected fused allocation:
mem_size = sizeof(*lpm) + (sizeof(lpm->rules_tbl[0]) * max_rules);
[...]
lpm = (struct rte_lpm_v20 *)rte_zmalloc_socket(mem_name,mem_size,
RTE_CACHE_LINE_SIZE, socket_id);
That causes lpm->rules_tbl not to have an own struct malloc_elem that
can be derived via RTE_PTR_SUB(data, MALLOC_ELEM_HEADER_LEN) in
malloc_elem_from_data.
Due to that the rte_lpm_free_v20 accidentially misderives the elem and
assumes it is ELEM_FREE triggering in malloc_elem_free
if (!malloc_elem_cookies_ok(elem) || elem->state !=
return -1;
While it seems counter-intuitive the way to properly remove rules_tbl in
the old fused allocation style of rte_lpm_free_v20 is to not remove it.
The newer rte_lpm_free_v1604 is safe because in rte_lpm_create_v1604
rules_tbl is a separate allocation.
Fixes: d4c18f0a1d5d ("lpm: fix missing free")
Signed-off-by: Christian Ehrhardt <christian.ehrhardt@canonical.com>
---
lib/librte_lpm/rte_lpm.c | 1 -
1 file changed, 1 deletion(-)
Comments
Hi, On 04/12/2016 03:49 PM, Christian Ehrhardt wrote: > Back then when we fixed the missing free lpm I was to quickly to say yes > if it applies not only to the lpm6 but also to all of the lpm code. > > It turned out to not apply to all of them. In rte_lpm_create_v20 there > is an unexpected fused allocation: > mem_size = sizeof(*lpm) + (sizeof(lpm->rules_tbl[0]) * max_rules); > [...] > lpm = (struct rte_lpm_v20 *)rte_zmalloc_socket(mem_name,mem_size, > RTE_CACHE_LINE_SIZE, socket_id); > > That causes lpm->rules_tbl not to have an own struct malloc_elem that > can be derived via RTE_PTR_SUB(data, MALLOC_ELEM_HEADER_LEN) in > malloc_elem_from_data. > Due to that the rte_lpm_free_v20 accidentially misderives the elem and > assumes it is ELEM_FREE triggering in malloc_elem_free > if (!malloc_elem_cookies_ok(elem) || elem->state != > return -1; > > While it seems counter-intuitive the way to properly remove rules_tbl in > the old fused allocation style of rte_lpm_free_v20 is to not remove it. > > The newer rte_lpm_free_v1604 is safe because in rte_lpm_create_v1604 > rules_tbl is a separate allocation. > > Fixes: d4c18f0a1d5d ("lpm: fix missing free") > > Signed-off-by: Christian Ehrhardt <christian.ehrhardt@canonical.com> Acked-by: Olivier Matz <olivier.matz@6wind.com> Thanks, I missed it too during the review.
> > Back then when we fixed the missing free lpm I was to quickly to say yes > > if it applies not only to the lpm6 but also to all of the lpm code. > > > > It turned out to not apply to all of them. In rte_lpm_create_v20 there > > is an unexpected fused allocation: > > mem_size = sizeof(*lpm) + (sizeof(lpm->rules_tbl[0]) * max_rules); > > [...] > > lpm = (struct rte_lpm_v20 *)rte_zmalloc_socket(mem_name,mem_size, > > RTE_CACHE_LINE_SIZE, socket_id); > > > > That causes lpm->rules_tbl not to have an own struct malloc_elem that > > can be derived via RTE_PTR_SUB(data, MALLOC_ELEM_HEADER_LEN) in > > malloc_elem_from_data. > > Due to that the rte_lpm_free_v20 accidentially misderives the elem and > > assumes it is ELEM_FREE triggering in malloc_elem_free > > if (!malloc_elem_cookies_ok(elem) || elem->state != > > return -1; > > > > While it seems counter-intuitive the way to properly remove rules_tbl in > > the old fused allocation style of rte_lpm_free_v20 is to not remove it. > > > > The newer rte_lpm_free_v1604 is safe because in rte_lpm_create_v1604 > > rules_tbl is a separate allocation. > > > > Fixes: d4c18f0a1d5d ("lpm: fix missing free") > > > > Signed-off-by: Christian Ehrhardt <christian.ehrhardt@canonical.com> > > Acked-by: Olivier Matz <olivier.matz@6wind.com> > > Thanks, I missed it too during the review. Applied, thanks
diff --git a/lib/librte_lpm/rte_lpm.c b/lib/librte_lpm/rte_lpm.c index 8bdf606..6f65d1c 100644 --- a/lib/librte_lpm/rte_lpm.c +++ b/lib/librte_lpm/rte_lpm.c @@ -373,7 +373,6 @@ rte_lpm_free_v20(struct rte_lpm_v20 *lpm) rte_rwlock_write_unlock(RTE_EAL_TAILQ_RWLOCK); - rte_free(lpm->rules_tbl); rte_free(lpm); rte_free(te); }