From: Ferruh Yigit <ferruh.yigit@intel.com>
Date: Wed, 3 May 2017 16:10:37 +0000 (+0100)
Subject: kni: fix crash caused by freeing mempool
X-Git-Tag: spdx-start~3282
X-Git-Url: http://git.droids-corp.org/?p=dpdk.git;a=commitdiff_plain;h=57a484e08a7ef3dea2018157d518b01a891ddfca

kni: fix crash caused by freeing mempool

To clean alloc_q, which has physical addresses of the mbufs, kni lib
free the pkt_mempool, but this leads a crash in kni unit test.

KNI library shouldn't free the pkt_mempool.

Implementation updated to find the mbufs in the alloc_q and return them
back to mempool.

Fixes: 8eba5ebd1811 ("kni: fix possible memory leak")
Cc: stable@dpdk.org

Signed-off-by: Ferruh Yigit <ferruh.yigit@intel.com>
---

diff --git a/lib/librte_kni/rte_kni.c b/lib/librte_kni/rte_kni.c
index 52fcd4be8f..c3f9208c12 100644
--- a/lib/librte_kni/rte_kni.c
+++ b/lib/librte_kni/rte_kni.c
@@ -451,17 +451,35 @@ kni_free_fifo(struct rte_kni_fifo *fifo)
 	} while (ret);
 }
 
+static void *
+va2pa(struct rte_mbuf *m)
+{
+	return (void *)((unsigned long)m -
+			((unsigned long)m->buf_addr -
+			 (unsigned long)m->buf_physaddr));
+}
+
 static void
-kni_free_fifo_phy(struct rte_mempool *pktmbuf_pool, struct rte_kni_fifo *fifo)
+obj_free(struct rte_mempool *mp __rte_unused, void *opaque, void *obj,
+		unsigned obj_idx __rte_unused)
+{
+	struct rte_mbuf *m = obj;
+	void *mbuf_phys = opaque;
+
+	if (va2pa(m) == mbuf_phys)
+		rte_pktmbuf_free(m);
+}
+
+static void
+kni_free_fifo_phy(struct rte_mempool *mp, struct rte_kni_fifo *fifo)
 {
 	void *mbuf_phys;
 	int ret;
 
-	rte_mempool_free(pktmbuf_pool);
-
-	/* All mbufs alredy freed with rte_mempoll_free, just free the fifo */
 	do {
 		ret = kni_fifo_get(fifo, &mbuf_phys, 1);
+		if (ret)
+			rte_mempool_obj_iter(mp, obj_free, mbuf_phys);
 	} while (ret);
 }
 
@@ -557,14 +575,6 @@ rte_kni_handle_request(struct rte_kni *kni)
 	return 0;
 }
 
-static void *
-va2pa(struct rte_mbuf *m)
-{
-	return (void *)((unsigned long)m -
-			((unsigned long)m->buf_addr -
-			 (unsigned long)m->buf_physaddr));
-}
-
 unsigned
 rte_kni_tx_burst(struct rte_kni *kni, struct rte_mbuf **mbufs, unsigned num)
 {