From patchwork Tue Aug 23 06:45:51 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yunjian Wang X-Patchwork-Id: 115353 X-Patchwork-Delegate: rasland@nvidia.com Return-Path: X-Original-To: patchwork@inbox.dpdk.org Delivered-To: patchwork@inbox.dpdk.org Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 0430AA0093; Tue, 23 Aug 2022 08:45:56 +0200 (CEST) Received: from [217.70.189.124] (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id E8C1040DFD; Tue, 23 Aug 2022 08:45:55 +0200 (CEST) Received: from szxga03-in.huawei.com (szxga03-in.huawei.com [45.249.212.189]) by mails.dpdk.org (Postfix) with ESMTP id 24066400D6; Tue, 23 Aug 2022 08:45:55 +0200 (CEST) Received: from dggpemm500021.china.huawei.com (unknown [172.30.72.56]) by szxga03-in.huawei.com (SkyGuard) with ESMTP id 4MBfpQ3h2NzGpnl; Tue, 23 Aug 2022 14:44:14 +0800 (CST) Received: from dggpemm500008.china.huawei.com (7.185.36.136) by dggpemm500021.china.huawei.com (7.185.36.109) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.24; Tue, 23 Aug 2022 14:45:53 +0800 Received: from localhost (10.174.242.157) by dggpemm500008.china.huawei.com (7.185.36.136) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.24; Tue, 23 Aug 2022 14:45:52 +0800 From: Yunjian Wang To: CC: , , , , , Yunjian Wang , Subject: [dpdk-dev] [PATCH v2 1/2] net/mlx5: fix use after free when releasing tx queues Date: Tue, 23 Aug 2022 14:45:51 +0800 Message-ID: <952a177cf4cc074101bb13773326b7107f496290.1661223500.git.wangyunjian@huawei.com> X-Mailer: git-send-email 1.9.5.msysgit.1 In-Reply-To: References: MIME-Version: 1.0 X-Originating-IP: [10.174.242.157] X-ClientProxiedBy: dggems703-chm.china.huawei.com (10.3.19.180) To dggpemm500008.china.huawei.com (7.185.36.136) X-CFilter-Loop: Reflected X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org The bonding slave remove function was calling the eth_dev_tx_queue_config function, which frees dev->data->tx_queues, and then tries to free priv->txqs[idx] in mlx5_txq_release function, which causes the heap use after free issue. Add checks whether dev->data->tx_queues is not NULL. Fixes: 94e257ec8ca ("net/mlx5: fix Rx/Tx queue checks") Cc: stable@dpdk.org Signed-off-by: Yunjian Wang --- drivers/net/mlx5/mlx5_txq.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/mlx5/mlx5_txq.c b/drivers/net/mlx5/mlx5_txq.c index 0140f8b3b2..cb2c33a060 100644 --- a/drivers/net/mlx5/mlx5_txq.c +++ b/drivers/net/mlx5/mlx5_txq.c @@ -1198,7 +1198,8 @@ mlx5_txq_release(struct rte_eth_dev *dev, uint16_t idx) struct mlx5_priv *priv = dev->data->dev_private; struct mlx5_txq_ctrl *txq_ctrl; - if (priv->txqs == NULL || (*priv->txqs)[idx] == NULL) + if (dev->data->tx_queues == NULL || priv->txqs == NULL || + (*priv->txqs)[idx] == NULL) return 0; txq_ctrl = container_of((*priv->txqs)[idx], struct mlx5_txq_ctrl, txq); if (__atomic_sub_fetch(&txq_ctrl->refcnt, 1, __ATOMIC_RELAXED) > 1) From patchwork Tue Aug 23 06:46:00 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yunjian Wang X-Patchwork-Id: 115354 X-Patchwork-Delegate: rasland@nvidia.com Return-Path: X-Original-To: patchwork@inbox.dpdk.org Delivered-To: patchwork@inbox.dpdk.org Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 55EDFA0093; Tue, 23 Aug 2022 08:46:08 +0200 (CEST) Received: from [217.70.189.124] (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id 4BF49427F1; Tue, 23 Aug 2022 08:46:08 +0200 (CEST) Received: from szxga02-in.huawei.com (szxga02-in.huawei.com [45.249.212.188]) by mails.dpdk.org (Postfix) with ESMTP id 0D42B400D6; Tue, 23 Aug 2022 08:46:07 +0200 (CEST) Received: from dggpemm500020.china.huawei.com (unknown [172.30.72.57]) by szxga02-in.huawei.com (SkyGuard) with ESMTP id 4MBfms1KbyzlVkX; Tue, 23 Aug 2022 14:42:53 +0800 (CST) Received: from dggpemm500008.china.huawei.com (7.185.36.136) by dggpemm500020.china.huawei.com (7.185.36.49) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.24; Tue, 23 Aug 2022 14:46:05 +0800 Received: from localhost (10.174.242.157) by dggpemm500008.china.huawei.com (7.185.36.136) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.24; Tue, 23 Aug 2022 14:46:05 +0800 From: Yunjian Wang To: CC: , , , , , Yunjian Wang , Subject: [dpdk-dev] [PATCH v2 2/2] net/mlx5: fix resource leak when releasing a drop action Date: Tue, 23 Aug 2022 14:46:00 +0800 Message-ID: X-Mailer: git-send-email 1.9.5.msysgit.1 In-Reply-To: References: MIME-Version: 1.0 X-Originating-IP: [10.174.242.157] X-ClientProxiedBy: dggems701-chm.china.huawei.com (10.3.19.178) To dggpemm500008.china.huawei.com (7.185.36.136) X-CFilter-Loop: Reflected X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Currently, the resources for hrxq->action are allocated in mlx5_devx_hrxq_new(). But it was not being freed when the drop action was released in mlx5_devx_drop_action_destroy(). So, fix is to free the resources in mlx5_devx_tir_destroy(). Fixes: bc5bee028ebc ("net/mlx5: create drop queue using DevX") Cc: stable@dpdk.org Signed-off-by: Yunjian Wang --- drivers/net/mlx5/mlx5_devx.c | 7 +++++++ drivers/net/mlx5/mlx5_rxq.c | 6 ------ 2 files changed, 7 insertions(+), 6 deletions(-) diff --git a/drivers/net/mlx5/mlx5_devx.c b/drivers/net/mlx5/mlx5_devx.c index 6886ae1f22..09c8856f05 100644 --- a/drivers/net/mlx5/mlx5_devx.c +++ b/drivers/net/mlx5/mlx5_devx.c @@ -907,6 +907,13 @@ mlx5_devx_hrxq_new(struct rte_eth_dev *dev, struct mlx5_hrxq *hrxq, static void mlx5_devx_tir_destroy(struct mlx5_hrxq *hrxq) { +#if defined(HAVE_IBV_FLOW_DV_SUPPORT) || !defined(HAVE_INFINIBAND_VERBS_H) + if (hrxq->hws_flags) + mlx5dr_action_destroy(hrxq->action); + else + mlx5_flow_os_destroy_flow_action(hrxq->action); + hrxq->action = NULL; +#endif claim_zero(mlx5_devx_cmd_destroy(hrxq->tir)); } diff --git a/drivers/net/mlx5/mlx5_rxq.c b/drivers/net/mlx5/mlx5_rxq.c index eaf23d0df4..e518fe9bfd 100644 --- a/drivers/net/mlx5/mlx5_rxq.c +++ b/drivers/net/mlx5/mlx5_rxq.c @@ -2861,12 +2861,6 @@ __mlx5_hrxq_remove(struct rte_eth_dev *dev, struct mlx5_hrxq *hrxq) { struct mlx5_priv *priv = dev->data->dev_private; -#ifdef HAVE_IBV_FLOW_DV_SUPPORT - if (hrxq->hws_flags) - mlx5dr_action_destroy(hrxq->action); - else - mlx5_glue->destroy_flow_action(hrxq->action); -#endif priv->obj_ops.hrxq_destroy(hrxq); if (!hrxq->standalone) { mlx5_ind_table_obj_release(dev, hrxq->ind_table,