common/mlx5: fix shared memory region ranges allocation

Memory regions (MRs) were allocated in one chunk of memory with a
mempool registration object. However, MRs can be reused among
different mempool registrations.

When the registration that allocated the MRs originally was
destroyed, the dangling pointers to the MRs could be left in other
registrations sharing these MRs.

Splitting the memory allocation of registration structure and MRs in
this commit solves this pointer reference issue.

Fixes: 690b2a88c2f7 ("common/mlx5: add mempool registration facilities")
Signed-off-by: Bing Zhao <bingz@nvidia.com>
Acked-by: Viacheslav Ovsiienko <viacheslavo@nvidia.com>
Reviewed-by: Dmitry Kozlyuk <dkozlyuk@nvidia.com>

diff --git a/drivers/common/mlx5/mlx5_common_mr.c b/drivers/common/mlx5/mlx5_common_mr.c
index 47121d8ff7a84d83c5e97d97ff74cb19a9a25a7a..01f35ebcdfe3a11773cf30c54981592040189422 100644 (file)
--- a/drivers/common/mlx5/mlx5_common_mr.c
+++ b/drivers/common/mlx5/mlx5_common_mr.c
@@ -1515,15 +1515,23 @@ mlx5_mempool_reg_create(struct rte_mempool *mp, unsigned int mrs_n,
        struct mlx5_mempool_reg *mpr = NULL;
 
        mpr = mlx5_malloc(MLX5_MEM_RTE | MLX5_MEM_ZERO,
-                         sizeof(*mpr) + mrs_n * sizeof(mpr->mrs[0]),
+                         sizeof(struct mlx5_mempool_reg),
                          RTE_CACHE_LINE_SIZE, SOCKET_ID_ANY);
        if (mpr == NULL) {
                DRV_LOG(ERR, "Cannot allocate mempool %s registration object",
                        mp->name);
                return NULL;
        }
+       mpr->mrs = mlx5_malloc(MLX5_MEM_RTE | MLX5_MEM_ZERO,
+                              mrs_n * sizeof(struct mlx5_mempool_mr),
+                              RTE_CACHE_LINE_SIZE, SOCKET_ID_ANY);
+       if (!mpr->mrs) {
+               DRV_LOG(ERR, "Cannot allocate mempool %s registration MRs",
+                       mp->name);
+               mlx5_free(mpr);
+               return NULL;
+       }
        mpr->mp = mp;
-       mpr->mrs = (struct mlx5_mempool_mr *)(mpr + 1);
        mpr->mrs_n = mrs_n;
        mpr->is_extmem = is_extmem;
        return mpr;
@@ -1544,6 +1552,7 @@ mlx5_mempool_reg_destroy(struct mlx5_mr_share_cache *share_cache,
 
                for (i = 0; i < mpr->mrs_n; i++)
                        share_cache->dereg_mr_cb(&mpr->mrs[i].pmd_mr);
+               mlx5_free(mpr->mrs);
        }
        mlx5_free(mpr);
 }