kni: fix crash caused by freeing mempool

To clean alloc_q, which has physical addresses of the mbufs, kni lib
free the pkt_mempool, but this leads a crash in kni unit test.

KNI library shouldn't free the pkt_mempool.

Implementation updated to find the mbufs in the alloc_q and return them
back to mempool.

Fixes: 8eba5ebd1811 ("kni: fix possible memory leak")
Cc: stable@dpdk.org
Signed-off-by: Ferruh Yigit <ferruh.yigit@intel.com>

diff --git a/lib/librte_kni/rte_kni.c b/lib/librte_kni/rte_kni.c
index 52fcd4b..c3f9208 100644 (file)
--- a/lib/librte_kni/rte_kni.c
+++ b/lib/librte_kni/rte_kni.c
@@ -451,17 +451,35 @@ kni_free_fifo(struct rte_kni_fifo *fifo)
        } while (ret);
 }
 
+static void *
+va2pa(struct rte_mbuf *m)
+{
+       return (void *)((unsigned long)m -
+                       ((unsigned long)m->buf_addr -
+                        (unsigned long)m->buf_physaddr));
+}
+
 static void
-kni_free_fifo_phy(struct rte_mempool *pktmbuf_pool, struct rte_kni_fifo *fifo)
+obj_free(struct rte_mempool *mp __rte_unused, void *opaque, void *obj,
+               unsigned obj_idx __rte_unused)
+{
+       struct rte_mbuf *m = obj;
+       void *mbuf_phys = opaque;
+
+       if (va2pa(m) == mbuf_phys)
+               rte_pktmbuf_free(m);
+}
+
+static void
+kni_free_fifo_phy(struct rte_mempool *mp, struct rte_kni_fifo *fifo)
 {
        void *mbuf_phys;
        int ret;
 
-       rte_mempool_free(pktmbuf_pool);
-
-       /* All mbufs alredy freed with rte_mempoll_free, just free the fifo */
        do {
                ret = kni_fifo_get(fifo, &mbuf_phys, 1);
+               if (ret)
+                       rte_mempool_obj_iter(mp, obj_free, mbuf_phys);
        } while (ret);
 }
 
@@ -557,14 +575,6 @@ rte_kni_handle_request(struct rte_kni *kni)
        return 0;
 }
 
-static void *
-va2pa(struct rte_mbuf *m)
-{
-       return (void *)((unsigned long)m -
-                       ((unsigned long)m->buf_addr -
-                        (unsigned long)m->buf_physaddr));
-}
-
 unsigned
 rte_kni_tx_burst(struct rte_kni *kni, struct rte_mbuf **mbufs, unsigned num)
 {