net/ice: fix memory leak in scalar Rx
Checks
Commit Message
If the buffer splitting feature is configured and the payload mbuf
allocation fails, the previously allocated header mbuf may be returned not
fully initialized or a memory leak may occur.
This patch handles this case correctly by freeing the corresponding header
buffer.
Fixes: 629dad3ef325 ("net/ice: support buffer split in scalar Rx")
Cc: yuanx.wang@intel.com
Cc: stable@dpdk.org
Signed-off-by: Vladimir Medvedkin <vladimir.medvedkin@intel.com>
---
drivers/net/ice/ice_rxtx.c | 10 ++++++++++
1 file changed, 10 insertions(+)
Comments
On Fri, Jan 17, 2025 at 05:52:05PM +0000, Vladimir Medvedkin wrote:
> If the buffer splitting feature is configured and the payload mbuf
> allocation fails, the previously allocated header mbuf may be returned not
> fully initialized or a memory leak may occur.
> This patch handles this case correctly by freeing the corresponding header
> buffer.
>
> Fixes: 629dad3ef325 ("net/ice: support buffer split in scalar Rx")
> Cc: yuanx.wang@intel.com
> Cc: stable@dpdk.org
>
> Signed-off-by: Vladimir Medvedkin <vladimir.medvedkin@intel.com>
Acked-by: Bruce Richardson <bruce.richardson@intel.com>
Patch applied to dpdk-next-net-intel.
Thanks,
/Bruce
@@ -484,6 +484,7 @@ ice_alloc_rx_queue_mbufs(struct ice_rx_queue *rxq)
struct rte_mbuf *mbuf_pay;
mbuf_pay = rte_mbuf_raw_alloc(rxq->rxseg[1].mp);
if (unlikely(!mbuf_pay)) {
+ rte_pktmbuf_free(mbuf);
PMD_DRV_LOG(ERR, "Failed to allocate payload mbuf for RX");
return -ENOMEM;
}
@@ -1900,6 +1901,8 @@ ice_rx_alloc_bufs(struct ice_rx_queue *rxq)
diag_pay = rte_mempool_get_bulk(rxq->rxseg[1].mp,
(void *)mbufs_pay, rxq->rx_free_thresh);
if (unlikely(diag_pay != 0)) {
+ rte_mempool_put_bulk(rxq->mp, (void *)rxep,
+ rxq->rx_free_thresh);
PMD_RX_LOG(ERR, "Failed to get payload mbufs in bulk");
return -ENOMEM;
}
@@ -2607,6 +2610,13 @@ ice_recv_pkts(void *rx_queue,
nmb_pay = rte_mbuf_raw_alloc(rxq->rxseg[1].mp);
if (unlikely(!nmb_pay)) {
rxq->vsi->adapter->pf.dev_data->rx_mbuf_alloc_failed++;
+ rxe->mbuf = NULL;
+ nb_hold--;
+ if (unlikely(rx_id == 0))
+ rx_id = rxq->nb_rx_desc;
+
+ rx_id--;
+ rte_pktmbuf_free(nmb);
break;
}