From: Chengwen Feng <fengchengwen@huawei.com>
Date: Tue, 17 Mar 2020 09:12:04 +0000 (+0800)
Subject: net/hns3: fix crash when flushing RSS flow rules with FLR
X-Git-Url: http://git.droids-corp.org/?a=commitdiff_plain;h=c064f6918c7a7efac119ea0556e6c71d8d27a3fa;p=dpdk.git

net/hns3: fix crash when flushing RSS flow rules with FLR

Currently, we encounter segmentation fault when performing the following
test case:
1. Run testpmd application, config the flow filter rules then flush them
   repeatedly.
2. Inject FLR concurrently every 5 second.
The calltrace info:

This GDB was configured as "aarch64-linux-gnu".
Reading symbols from ./testpmd...(no debugging symbols found)...done.
[New LWP 322]
[New LWP 325]
[New LWP 324]
[New LWP 326]
[New LWP 323]
[New LWP 327]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/aarch64-linux-gnu/
libthread_db.so.1".
Core was generated by `/home/root/app/testpmd -w 0000:00:01.0 -w
0000:00:02.0 -w 0000:00:03.0 -l 0-3 -'.
Program terminated with signal SIGSEGV, Segmentation fault.
libc.so.6
[Current thread is 1 (Thread 0xffff8bb35110 (LWP 322))]
(gdb) bt
 #0  0x0000ffff8b936a90 in strlen () from /lib/aarch64-linux-gnu/
 libc.so.6
 #1  0x0000ffff8b905ccc in vfprintf () from /lib/aarch64-linux-gnu/
 libc.so.6
 #2  0x0000ffff8b993d04 in __printf_chk () from /lib/aarch64-linux-gnu/
 libc.so.6
 #3  0x0000000000754828 in port_flow_flush ()
 #4  0x0000000000870f3c in cmdline_parse ()

The root cause as follows：
In the '.flush' ops implementation function named hns3_flow_flush, By
the way the '.flush' ops is defined in the struct rte_flow_ops, if
failed to call hns3_clear_rss_filter, the out parameter error is not
set, and then the member variable name message in the struct error is
invalid(filled with 0x44444444 in port_flow_flush function of the
testpmd application), it leads to segmentation fault when format the
message.

We fixes it by filling error parameter when failure in calling static
function named hns3_clear_rss_filter in the the '.flush' ops
implementation function named hns3_flow_flush.

Fixes: c37ca66f2b27 ("net/hns3: support RSS")
Cc: stable@dpdk.org

Signed-off-by: Chengwen Feng <fengchengwen@huawei.com>
Signed-off-by: Wei Hu (Xavier) <xavier.huwei@huawei.com>
---

diff --git a/drivers/net/hns3/hns3_flow.c b/drivers/net/hns3/hns3_flow.c
index 98affa5679..559b9d02b1 100644
--- a/drivers/net/hns3/hns3_flow.c
+++ b/drivers/net/hns3/hns3_flow.c
@@ -1827,8 +1827,11 @@ hns3_flow_flush(struct rte_eth_dev *dev, struct rte_flow_error *error)
 	}
 
 	ret = hns3_clear_rss_filter(dev);
-	if (ret)
+	if (ret) {
+		rte_flow_error_set(error, ret, RTE_FLOW_ERROR_TYPE_HANDLE,
+				   NULL, "Failed to flush rss filter");
 		return ret;
+	}
 
 	hns3_filterlist_flush(dev);