From 090826e4646db4a438336c5e9e879f2fa5a6e07a Mon Sep 17 00:00:00 2001 From: Huisong Li Date: Fri, 27 Oct 2023 14:09:41 +0800 Subject: [PATCH 371/394] net/hns3: fix crash for NEON and SVE [ upstream commit 01843ab2f2fc8c3137258ec39b2cb6f62ba7b8a2 ] Driver may fail to allocate bulk mbufs for Neon and SVE when rearm mbuf. Currently, driver keeps going to handle packets even if there isn't available descriptors to receive packets at this moment. As a result, driver probably fills the mbufs with invalid data to application and accesses to illegal address because of the VLD bit of the descriptor at the "rx_rearm_start" position still being set. So driver has to clear VLD bit for this descriptor in this scenario in case of receiving packets later. In addition, it is possible that the sum of the "rx_rearm_nb" and "rx_rearm_start" is greater than total descriptor number of Rx queue in the above scenario. So the index of rxq->sw_ring[] to set mbuf pointer to NULL should also be fixed to avoid out-of-bounds memory access. Fixes: a3d4f4d291d7 ("net/hns3: support NEON Rx") Fixes: f81a18f49152 ("net/hns3: fix mbuf leakage when RxQ started after reset") Cc: stable@dpdk.org Signed-off-by: Huisong Li --- drivers/net/hns3/hns3_rxtx.c | 2 +- drivers/net/hns3/hns3_rxtx_vec.h | 5 +++++ 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/net/hns3/hns3_rxtx.c b/drivers/net/hns3/hns3_rxtx.c index 208c725cd5..3054d24080 100644 --- a/drivers/net/hns3/hns3_rxtx.c +++ b/drivers/net/hns3/hns3_rxtx.c @@ -51,7 +51,7 @@ hns3_rx_queue_release_mbufs(struct hns3_rx_queue *rxq) } } for (i = 0; i < rxq->rx_rearm_nb; i++) - rxq->sw_ring[rxq->rx_rearm_start + i].mbuf = NULL; + rxq->sw_ring[(rxq->rx_rearm_start + i) % rxq->nb_rx_desc].mbuf = NULL; } for (i = 0; i < rxq->bulk_mbuf_num; i++) diff --git a/drivers/net/hns3/hns3_rxtx_vec.h b/drivers/net/hns3/hns3_rxtx_vec.h index a9a6774294..9018e79c2f 100644 --- a/drivers/net/hns3/hns3_rxtx_vec.h +++ b/drivers/net/hns3/hns3_rxtx_vec.h @@ -106,6 +106,11 @@ hns3_rxq_rearm_mbuf(struct hns3_rx_queue *rxq) if (unlikely(rte_mempool_get_bulk(rxq->mb_pool, (void *)rxep, HNS3_DEFAULT_RXQ_REARM_THRESH) < 0)) { + /* + * Clear VLD bit for the first descriptor rearmed in case + * of going to receive packets later. + */ + rxdp[0].rx.bd_base_info = 0; rte_eth_devices[rxq->port_id].data->rx_mbuf_alloc_failed++; return; } -- 2.23.0