From patchwork Wed Aug 3 13:16:04 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yunjian Wang X-Patchwork-Id: 114581 X-Patchwork-Delegate: rasland@nvidia.com Return-Path: X-Original-To: patchwork@inbox.dpdk.org Delivered-To: patchwork@inbox.dpdk.org Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 5A4C4A00C5; Wed, 3 Aug 2022 15:16:09 +0200 (CEST) Received: from [217.70.189.124] (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 4D6DF42BA4; Wed, 3 Aug 2022 15:16:09 +0200 (CEST) Received: from szxga08-in.huawei.com (szxga08-in.huawei.com [45.249.212.255]) by mails.dpdk.org (Postfix) with ESMTP id 0990F40141; Wed, 3 Aug 2022 15:16:08 +0200 (CEST) Received: from dggpemm500023.china.huawei.com (unknown [172.30.72.53]) by szxga08-in.huawei.com (SkyGuard) with ESMTP id 4LyXNH3DRXz1M8TX; Wed, 3 Aug 2022 21:13:03 +0800 (CST) Received: from dggpemm500008.china.huawei.com (7.185.36.136) by dggpemm500023.china.huawei.com (7.185.36.83) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.24; Wed, 3 Aug 2022 21:16:05 +0800 Received: from localhost (10.174.242.157) by dggpemm500008.china.huawei.com (7.185.36.136) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.24; Wed, 3 Aug 2022 21:16:05 +0800 From: Yunjian Wang To: CC: , , , Yunjian Wang , Subject: [dpdk-dev] [PATCH 1/2] net/mlx5: fix use after free when releasing tx queues Date: Wed, 3 Aug 2022 21:16:04 +0800 Message-ID: <952a177cf4cc074101bb13773326b7107f496290.1659526016.git.wangyunjian@huawei.com> X-Mailer: git-send-email 1.9.5.msysgit.1 In-Reply-To: References: MIME-Version: 1.0 X-Originating-IP: [10.174.242.157] X-ClientProxiedBy: dggems706-chm.china.huawei.com (10.3.19.183) To dggpemm500008.china.huawei.com (7.185.36.136) X-CFilter-Loop: Reflected X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org The bonding slave remove function was calling the eth_dev_tx_queue_config function, which frees dev->data->tx_queues, and then tries to free priv->txqs[idx] in mlx5_txq_release function, which causes the heap use after free issue. Add checks whether dev->data->tx_queues is not NULL. Fixes: 94e257ec8ca ("net/mlx5: fix Rx/Tx queue checks") Cc: stable@dpdk.org Signed-off-by: Yunjian Wang --- drivers/net/mlx5/mlx5_txq.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/mlx5/mlx5_txq.c b/drivers/net/mlx5/mlx5_txq.c index 0140f8b3b2..cb2c33a060 100644 --- a/drivers/net/mlx5/mlx5_txq.c +++ b/drivers/net/mlx5/mlx5_txq.c @@ -1198,7 +1198,8 @@ mlx5_txq_release(struct rte_eth_dev *dev, uint16_t idx) struct mlx5_priv *priv = dev->data->dev_private; struct mlx5_txq_ctrl *txq_ctrl; - if (priv->txqs == NULL || (*priv->txqs)[idx] == NULL) + if (dev->data->tx_queues == NULL || priv->txqs == NULL || + (*priv->txqs)[idx] == NULL) return 0; txq_ctrl = container_of((*priv->txqs)[idx], struct mlx5_txq_ctrl, txq); if (__atomic_sub_fetch(&txq_ctrl->refcnt, 1, __ATOMIC_RELAXED) > 1) From patchwork Wed Aug 3 13:16:12 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yunjian Wang X-Patchwork-Id: 114582 X-Patchwork-Delegate: rasland@nvidia.com Return-Path: X-Original-To: patchwork@inbox.dpdk.org Delivered-To: patchwork@inbox.dpdk.org Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 56352A00C5; Wed, 3 Aug 2022 15:16:16 +0200 (CEST) Received: from [217.70.189.124] (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 4972442B9D; Wed, 3 Aug 2022 15:16:16 +0200 (CEST) Received: from szxga01-in.huawei.com (szxga01-in.huawei.com [45.249.212.187]) by mails.dpdk.org (Postfix) with ESMTP id 50D7C42B86; Wed, 3 Aug 2022 15:16:15 +0200 (CEST) Received: from dggpemm500024.china.huawei.com (unknown [172.30.72.53]) by szxga01-in.huawei.com (SkyGuard) with ESMTP id 4LyXPh1xTxzmV9K; Wed, 3 Aug 2022 21:14:16 +0800 (CST) Received: from dggpemm500008.china.huawei.com (7.185.36.136) by dggpemm500024.china.huawei.com (7.185.36.203) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.24; Wed, 3 Aug 2022 21:16:13 +0800 Received: from localhost (10.174.242.157) by dggpemm500008.china.huawei.com (7.185.36.136) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.24; Wed, 3 Aug 2022 21:16:13 +0800 From: Yunjian Wang To: CC: , , , Yunjian Wang , Subject: [dpdk-dev] [PATCH 2/2] net/mlx5: fix resource leak when releasing a drop action Date: Wed, 3 Aug 2022 21:16:12 +0800 Message-ID: X-Mailer: git-send-email 1.9.5.msysgit.1 In-Reply-To: References: MIME-Version: 1.0 X-Originating-IP: [10.174.242.157] X-ClientProxiedBy: dggems706-chm.china.huawei.com (10.3.19.183) To dggpemm500008.china.huawei.com (7.185.36.136) X-CFilter-Loop: Reflected X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Currently, the resources for hrxq->action are allocated in mlx5_devx_hrxq_new(). But it was not being freed when the drop action was released in mlx5_devx_drop_action_destroy(). So, fix is to free the resources in mlx5_devx_tir_destroy(). Fixes: bc5bee028ebc ("net/mlx5: create drop queue using DevX") Cc: stable@dpdk.org Signed-off-by: Yunjian Wang --- drivers/net/mlx5/mlx5_devx.c | 6 ++++++ drivers/net/mlx5/mlx5_rxq.c | 6 ------ 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/drivers/net/mlx5/mlx5_devx.c b/drivers/net/mlx5/mlx5_devx.c index 6886ae1f22..38a4a7c802 100644 --- a/drivers/net/mlx5/mlx5_devx.c +++ b/drivers/net/mlx5/mlx5_devx.c @@ -907,6 +907,12 @@ mlx5_devx_hrxq_new(struct rte_eth_dev *dev, struct mlx5_hrxq *hrxq, static void mlx5_devx_tir_destroy(struct mlx5_hrxq *hrxq) { +#if defined(HAVE_IBV_FLOW_DV_SUPPORT) || !defined(HAVE_INFINIBAND_VERBS_H) + if (hrxq->hws_flags) + mlx5dr_action_destroy(hrxq->action); + else + mlx5_glue->destroy_flow_action(hrxq->action); +#endif claim_zero(mlx5_devx_cmd_destroy(hrxq->tir)); } diff --git a/drivers/net/mlx5/mlx5_rxq.c b/drivers/net/mlx5/mlx5_rxq.c index eaf23d0df4..e518fe9bfd 100644 --- a/drivers/net/mlx5/mlx5_rxq.c +++ b/drivers/net/mlx5/mlx5_rxq.c @@ -2861,12 +2861,6 @@ __mlx5_hrxq_remove(struct rte_eth_dev *dev, struct mlx5_hrxq *hrxq) { struct mlx5_priv *priv = dev->data->dev_private; -#ifdef HAVE_IBV_FLOW_DV_SUPPORT - if (hrxq->hws_flags) - mlx5dr_action_destroy(hrxq->action); - else - mlx5_glue->destroy_flow_action(hrxq->action); -#endif priv->obj_ops.hrxq_destroy(hrxq); if (!hrxq->standalone) { mlx5_ind_table_obj_release(dev, hrxq->ind_table,