diff mbox series

[1/3] net/nfp: fix wrong increment of free list counter

Message ID 20221118014408.19565-2-chaoyong.he@corigine.com (mailing list archive)
State Accepted, archived
Delegated to: Ferruh Yigit
Headers
Series fix wrong increment of free list counter |

Checks

Context Check Description
ci/checkpatch success coding style OK

Commit Message

Chaoyong He Nov. 18, 2022, 1:44 a.m. UTC 
  When receiving a packet that is larger than the mbuf size, the Rx
function will break the receive loop and sent a free list descriptor
with random DMA address.

Fix this by moving the increment of the free list descriptor counter
to after the packet size have been checked and acted on.

Fixes: bb340f56fcb7 ("net/nfp: fix memory leak in Rx")
Cc: long.wu@corigine.com
Cc: stable@dpdk.org

Signed-off-by: Chaoyong He <chaoyong.he@corigine.com>
Reviewed-by: Niklas Söderlund <niklas.soderlund@corigine.com>
---
 drivers/net/nfp/nfp_rxtx.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

Comments

Ferruh Yigit Nov. 18, 2022, 2:04 p.m. UTC | #1 
On 11/18/2022 1:44 AM, Chaoyong He wrote:
> When receiving a packet that is larger than the mbuf size, the Rx
> function will break the receive loop and sent a free list descriptor
> with random DMA address.
> 
> Fix this by moving the increment of the free list descriptor counter
> to after the packet size have been checked and acted on.
> 

Issue seems one of the Rx descriptor is not rearmed properly and may
have random DMA address, which can lead HW to DMA this random address,
so implications can be dangerous.

I suggest updating patch title slightly to highlight the impact:
"net/nfp: fix Rx descriptor DMA address"

> Fixes: bb340f56fcb7 ("net/nfp: fix memory leak in Rx")
> Cc: long.wu@corigine.com
> Cc: stable@dpdk.org
> 
> Signed-off-by: Chaoyong He <chaoyong.he@corigine.com>
> Reviewed-by: Niklas Söderlund <niklas.soderlund@corigine.com>

Series applied to dpdk-next-net/main, thanks.
diff mbox series

Patch

diff --git a/drivers/net/nfp/nfp_rxtx.c b/drivers/net/nfp/nfp_rxtx.c
index b8c874d315..38377ca218 100644
--- a/drivers/net/nfp/nfp_rxtx.c
+++ b/drivers/net/nfp/nfp_rxtx.c
@@ -293,8 +293,6 @@  nfp_net_recv_pkts(void *rx_queue, struct rte_mbuf **rx_pkts, uint16_t nb_pkts)
 			break;
 		}
 
-		nb_hold++;
-
 		/*
 		 * Grab the mbuf and refill the descriptor with the
 		 * previously allocated mbuf
@@ -365,6 +363,7 @@  nfp_net_recv_pkts(void *rx_queue, struct rte_mbuf **rx_pkts, uint16_t nb_pkts)
 		rxds->fld.dd = 0;
 		rxds->fld.dma_addr_hi = (dma_addr >> 32) & 0xff;
 		rxds->fld.dma_addr_lo = dma_addr & 0xffffffff;
+		nb_hold++;
 
 		rxq->rd_p++;
 		if (unlikely(rxq->rd_p == rxq->rx_count)) /* wrapping?*/