From c9678e49feef4e423ebd917c7670fee238f4c2bb Mon Sep 17 00:00:00 2001 From: Jiawei Zhu Date: Mon, 1 Mar 2021 12:19:50 -0500 Subject: [PATCH] net/mlx5: fix Rx segmented packets on mbuf starvation The issue occurred if mbuf starvation happened in the middle of segmented packet reception. In such a situation, after release the segments of packet being received, code did not advance the consumer index to the next stride. This caused the receiving of the wrong segmented packet data. The possible error scenario: - we assume segs_n is 4 and we are receiving 4 segments of multi-segment packet. - we fail to allocate mbuf while receiving the 3rd segment, and this frees the mbufs of the packet chain we have built. There are the 1st and 2nd segments in the chain. - the 1st and the 2nd segments of this stride of Rx queue are filled up (in elts array) with the new allocated mbufs and their data are random (the 3rd and 4th segments still contain the valid data of the packet though). - on the next iteration of stride processing we get the wrong two segments of the multi-segment packet. Hence, we should skip these mbufs in the stride and we should advance the consumer index on loop exit. Fixes: 15a756b63734 ("net/mlx5: fix possible NULL dereference in Rx path") Cc: stable@dpdk.org Signed-off-by: Jiawei Zhu Acked-by: Viacheslav Ovsiienko --- drivers/net/mlx5/mlx5_rxtx.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/mlx5/mlx5_rxtx.c b/drivers/net/mlx5/mlx5_rxtx.c index 2e4b87c3e5..e3ce9fd224 100644 --- a/drivers/net/mlx5/mlx5_rxtx.c +++ b/drivers/net/mlx5/mlx5_rxtx.c @@ -1480,6 +1480,9 @@ mlx5_rx_burst(void *dpdk_rxq, struct rte_mbuf **pkts, uint16_t pkts_n) rte_mbuf_raw_free(pkt); pkt = rep; } + rq_ci >>= sges_n; + ++rq_ci; + rq_ci <<= sges_n; break; } if (!pkt) { -- 2.20.1