fm10k: fix crash when closing

When the fm10k port is closed, both func tx_queue_clean() and
fm10k_tx_queue_release_mbufs_vec() will try to release buffer in
SW ring. The latter func won't do sanity check on those pointers
and cause crash.

The fix removed Vector TX buffer release func since it can share
the release functions with regular TX.

Fixes: fb9066e479a6 ("fm10k: reset and release mbuf for vector Tx")

Signed-off-by: Chen Jing D(Mark) <jing.d.chen@intel.com>
Acked-by: Michael Qiu <michael.qiu@intel.com>

diff --git a/drivers/net/fm10k/fm10k.h b/drivers/net/fm10k/fm10k.h
index 754aa6a..38d5489 100644 (file)
--- a/drivers/net/fm10k/fm10k.h
+++ b/drivers/net/fm10k/fm10k.h
@@ -237,7 +237,6 @@ struct fm10k_tx_queue {
 };
 
 struct fm10k_txq_ops {
-       void (*release_mbufs)(struct fm10k_tx_queue *txq);
        void (*reset)(struct fm10k_tx_queue *txq);
 };
 

diff --git a/drivers/net/fm10k/fm10k_ethdev.c b/drivers/net/fm10k/fm10k_ethdev.c
index 441f713..7f5c852 100644 (file)
--- a/drivers/net/fm10k/fm10k_ethdev.c
+++ b/drivers/net/fm10k/fm10k_ethdev.c
@@ -386,7 +386,6 @@ fm10k_check_mq_mode(struct rte_eth_dev *dev)
 }
 
 static const struct fm10k_txq_ops def_txq_ops = {
-       .release_mbufs = tx_queue_free,
        .reset = tx_queue_reset,
 };
 
@@ -1073,7 +1072,7 @@ fm10k_dev_queue_release(struct rte_eth_dev *dev)
                for (i = 0; i < dev->data->nb_tx_queues; i++) {
                        struct fm10k_tx_queue *txq = dev->data->tx_queues[i];
 
-                       txq->ops->release_mbufs(txq);
+                       tx_queue_free(txq);
                }
        }
 
@@ -1761,7 +1760,7 @@ fm10k_tx_queue_setup(struct rte_eth_dev *dev, uint16_t queue_id,
        if (dev->data->tx_queues[queue_id] != NULL) {
                struct fm10k_tx_queue *txq = dev->data->tx_queues[queue_id];
 
-               txq->ops->release_mbufs(txq);
+               tx_queue_free(txq);
                dev->data->tx_queues[queue_id] = NULL;
        }
 
@@ -1836,7 +1835,7 @@ fm10k_tx_queue_release(void *queue)
        struct fm10k_tx_queue *q = queue;
        PMD_INIT_FUNC_TRACE();
 
-       q->ops->release_mbufs(q);
+       tx_queue_free(q);
 }
 
 static int

diff --git a/drivers/net/fm10k/fm10k_rxtx_vec.c b/drivers/net/fm10k/fm10k_rxtx_vec.c
index 06beca9..6042568 100644 (file)
--- a/drivers/net/fm10k/fm10k_rxtx_vec.c
+++ b/drivers/net/fm10k/fm10k_rxtx_vec.c
@@ -44,8 +44,6 @@
 #pragma GCC diagnostic ignored "-Wcast-qual"
 #endif
 
-static void
-fm10k_tx_queue_release_mbufs_vec(struct fm10k_tx_queue *txq);
 static void
 fm10k_reset_tx_queue(struct fm10k_tx_queue *txq);
 
@@ -634,7 +632,6 @@ fm10k_recv_scattered_pkts_vec(void *rx_queue,
 }
 
 static const struct fm10k_txq_ops vec_txq_ops = {
-       .release_mbufs = fm10k_tx_queue_release_mbufs_vec,
        .reset = fm10k_reset_tx_queue,
 };
 
@@ -794,31 +791,6 @@ fm10k_xmit_pkts_vec(void *tx_queue, struct rte_mbuf **tx_pkts,
        return nb_pkts;
 }
 
-static void __attribute__((cold))
-fm10k_tx_queue_release_mbufs_vec(struct fm10k_tx_queue *txq)
-{
-       unsigned i;
-       const uint16_t max_desc = (uint16_t)(txq->nb_desc - 1);
-
-       if (txq->sw_ring == NULL || txq->nb_free == max_desc)
-               return;
-
-       /* release the used mbufs in sw_ring */
-       for (i = txq->next_dd - (txq->rs_thresh - 1);
-            i != txq->next_free;
-            i = (i + 1) & max_desc)
-               rte_pktmbuf_free_seg(txq->sw_ring[i]);
-
-       txq->nb_free = max_desc;
-
-       /* reset tx_entry */
-       for (i = 0; i < txq->nb_desc; i++)
-               txq->sw_ring[i] = NULL;
-
-       rte_free(txq->sw_ring);
-       txq->sw_ring = NULL;
-}
-
 static void __attribute__((cold))
 fm10k_reset_tx_queue(struct fm10k_tx_queue *txq)
 {