When the tap_write_mbufs() function return with break, mbuf was freed
without increasing num_packets, which could cause applications to free
the mbuf again. And the pmd_tx_burst() function should returns the
number of original packets it actually sent excluding tso mbufs.
Fixes:
9396ad334672 ("net/tap: fix reported number of Tx packets")
Cc: stable@dpdk.org
Signed-off-by: Yunjian Wang <wangyunjian@huawei.com>
Reviewed-by: Ferruh Yigit <ferruh.yigit@intel.com>
Acked-by: Stephen Hemminger <stephen@networkplumber.org>
tap_write_mbufs(struct tx_queue *txq, uint16_t num_mbufs,
struct rte_mbuf **pmbufs,
uint16_t *num_packets, unsigned long *num_tx_bytes)
tap_write_mbufs(struct tx_queue *txq, uint16_t num_mbufs,
struct rte_mbuf **pmbufs,
uint16_t *num_packets, unsigned long *num_tx_bytes)
seg_len = rte_pktmbuf_data_len(mbuf);
l234_hlen = mbuf->l2_len + mbuf->l3_len + mbuf->l4_len;
if (seg_len < l234_hlen)
seg_len = rte_pktmbuf_data_len(mbuf);
l234_hlen = mbuf->l2_len + mbuf->l3_len + mbuf->l4_len;
if (seg_len < l234_hlen)
/* To change checksums, work on a * copy of l2, l3
* headers + l4 pseudo header
/* To change checksums, work on a * copy of l2, l3
* headers + l4 pseudo header
/* copy the tx frame data */
n = writev(process_private->txq_fds[txq->queue_id], iovecs, j);
if (n <= 0)
/* copy the tx frame data */
n = writev(process_private->txq_fds[txq->queue_id], iovecs, j);
if (n <= 0)
(*num_packets)++;
(*num_tx_bytes) += rte_pktmbuf_pkt_len(mbuf);
}
(*num_packets)++;
(*num_tx_bytes) += rte_pktmbuf_pkt_len(mbuf);
}
}
/* Callback to handle sending packets from the tap interface
}
/* Callback to handle sending packets from the tap interface
uint16_t num_mbufs = 0;
uint16_t tso_segsz = 0;
int ret;
uint16_t num_mbufs = 0;
uint16_t tso_segsz = 0;
int ret;
uint64_t tso;
tso = mbuf_in->ol_flags & PKT_TX_TCP_SEG;
uint64_t tso;
tso = mbuf_in->ol_flags & PKT_TX_TCP_SEG;
break;
}
gso_ctx->gso_size = tso_segsz;
break;
}
gso_ctx->gso_size = tso_segsz;
- ret = rte_gso_segment(mbuf_in, /* packet to segment */
+ /* 'mbuf_in' packet to segment */
+ num_tso_mbufs = rte_gso_segment(mbuf_in,
gso_ctx, /* gso control block */
(struct rte_mbuf **)&gso_mbufs, /* out mbufs */
RTE_DIM(gso_mbufs)); /* max tso mbufs */
/* ret contains the number of new created mbufs */
gso_ctx, /* gso control block */
(struct rte_mbuf **)&gso_mbufs, /* out mbufs */
RTE_DIM(gso_mbufs)); /* max tso mbufs */
/* ret contains the number of new created mbufs */
+ num_mbufs = num_tso_mbufs;
} else {
/* stats.errs will be incremented */
if (rte_pktmbuf_pkt_len(mbuf_in) > max_size)
break;
/* ret 0 indicates no new mbufs were created */
} else {
/* stats.errs will be incremented */
if (rte_pktmbuf_pkt_len(mbuf_in) > max_size)
break;
/* ret 0 indicates no new mbufs were created */
mbuf = &mbuf_in;
num_mbufs = 1;
}
mbuf = &mbuf_in;
num_mbufs = 1;
}
- tap_write_mbufs(txq, num_mbufs, mbuf,
+ ret = tap_write_mbufs(txq, num_mbufs, mbuf,
&num_packets, &num_tx_bytes);
&num_packets, &num_tx_bytes);
+ if (ret == -1) {
+ txq->stats.errs++;
+ /* free tso mbufs */
+ if (num_tso_mbufs > 0)
+ rte_pktmbuf_free_bulk(mbuf, num_tso_mbufs);
+ break;
+ }
num_tx++;
/* free original mbuf */
rte_pktmbuf_free(mbuf_in);
/* free tso mbufs */
num_tx++;
/* free original mbuf */
rte_pktmbuf_free(mbuf_in);
/* free tso mbufs */
- for (j = 0; j < ret; j++)
- rte_pktmbuf_free(mbuf[j]);
+ if (num_tso_mbufs > 0)
+ rte_pktmbuf_free_bulk(mbuf, num_tso_mbufs);
}
txq->stats.opackets += num_packets;
txq->stats.errs += nb_pkts - num_tx;
txq->stats.obytes += num_tx_bytes;
}
txq->stats.opackets += num_packets;
txq->stats.errs += nb_pkts - num_tx;
txq->stats.obytes += num_tx_bytes;