7573bb9b6f
Sync some patches from upstream about bugfix, modifies are as follow: - app/testpmd: fix crash in multi-process forwarding - net/hns3: fix offload flag of IEEE 1588 - net/hns3: fix read Rx timestamp handle - net/hns3: fix double free for Rx/Tx queue - net/hns3: fix variable overflow - net/hns3: enable PFC for all user priorities - ring: add telemetry command for ring info - ring: add telemetry command to list rings - net/hns3: support power monitor - net/hns3: disable SCTP verification tag for RSS hash input - app/testpmd: fix RSS algorithm choice
69 lines
1.9 KiB
Diff
69 lines
1.9 KiB
Diff
From c73d2a88d8731412cfa5c4e9f10facbeb74e5a04 Mon Sep 17 00:00:00 2001
|
|
From: Dengdui Huang <huangdengdui@huawei.com>
|
|
Date: Wed, 3 Apr 2024 18:16:21 +0800
|
|
Subject: [PATCH 426/431] net/hns3: fix double free for Rx/Tx queue
|
|
|
|
[ upstream commit 833a5beab5bfc16708ee9b53c83e2f221cd99f90 ]
|
|
|
|
The Pointers to some resources on the Rx/Tx queue need to be set to NULL
|
|
after free inside the hns3_rx/tx_queue_release(), as this function is
|
|
called from multiple threads (reset thread, device config thread, etc),
|
|
leading to double memory free error.
|
|
|
|
Fixes: bba636698316 ("net/hns3: support Rx/Tx and related operations")
|
|
Cc: stable@dpdk.org
|
|
|
|
Signed-off-by: Dengdui Huang <huangdengdui@huawei.com>
|
|
Signed-off-by: Jie Hai <haijie1@huawei.com>
|
|
Signed-off-by: chenyi <chenyi211@huawei.com>
|
|
---
|
|
drivers/net/hns3/hns3_rxtx.c | 23 ++++++++++++++++++-----
|
|
1 file changed, 18 insertions(+), 5 deletions(-)
|
|
|
|
diff --git a/drivers/net/hns3/hns3_rxtx.c b/drivers/net/hns3/hns3_rxtx.c
|
|
index 49f7177578..0b8c59f4f9 100644
|
|
--- a/drivers/net/hns3/hns3_rxtx.c
|
|
+++ b/drivers/net/hns3/hns3_rxtx.c
|
|
@@ -86,9 +86,14 @@ hns3_rx_queue_release(void *queue)
|
|
struct hns3_rx_queue *rxq = queue;
|
|
if (rxq) {
|
|
hns3_rx_queue_release_mbufs(rxq);
|
|
- if (rxq->mz)
|
|
+ if (rxq->mz) {
|
|
rte_memzone_free(rxq->mz);
|
|
- rte_free(rxq->sw_ring);
|
|
+ rxq->mz = NULL;
|
|
+ }
|
|
+ if (rxq->sw_ring) {
|
|
+ rte_free(rxq->sw_ring);
|
|
+ rxq->sw_ring = NULL;
|
|
+ }
|
|
rte_free(rxq);
|
|
}
|
|
}
|
|
@@ -99,10 +104,18 @@ hns3_tx_queue_release(void *queue)
|
|
struct hns3_tx_queue *txq = queue;
|
|
if (txq) {
|
|
hns3_tx_queue_release_mbufs(txq);
|
|
- if (txq->mz)
|
|
+ if (txq->mz) {
|
|
rte_memzone_free(txq->mz);
|
|
- rte_free(txq->sw_ring);
|
|
- rte_free(txq->free);
|
|
+ txq->mz = NULL;
|
|
+ }
|
|
+ if (txq->sw_ring) {
|
|
+ rte_free(txq->sw_ring);
|
|
+ txq->sw_ring = NULL;
|
|
+ }
|
|
+ if (txq->free) {
|
|
+ rte_free(txq->free);
|
|
+ txq->free = NULL;
|
|
+ }
|
|
rte_free(txq);
|
|
}
|
|
}
|
|
--
|
|
2.33.0
|
|
|