From d43b8c710836db953fad1bb6449a827e19b5a87a Mon Sep 17 00:00:00 2001 From: Long Li Date: Tue, 23 Jun 2020 18:11:45 -0700 Subject: [PATCH] net/netvsc: fix underflow when Rx external mbuf When rte_pktmbuf_attach_extbuf() is used, the driver should not decrease the reference count in its callback function hn_rx_buf_free_cb, because the reference count is already decreased by rte_pktmbuf. Doing it twice may result in underflow and driver may never send an ack packet over vmbus to host. Also declares rxbuf_outstanding as atomic, because this value is shared among all receive queues. Fixes: 4e9c73e96e83 ("net/netvsc: add Hyper-V network device") Cc: stable@dpdk.org Signed-off-by: Long Li Acked-by: Stephen Hemminger --- drivers/net/netvsc/hn_nvs.c | 1 - drivers/net/netvsc/hn_rxtx.c | 30 +++++++++++------------------- drivers/net/netvsc/hn_var.h | 2 +- 3 files changed, 12 insertions(+), 21 deletions(-) diff --git a/drivers/net/netvsc/hn_nvs.c b/drivers/net/netvsc/hn_nvs.c index 477202b2a0..f88854dafc 100644 --- a/drivers/net/netvsc/hn_nvs.c +++ b/drivers/net/netvsc/hn_nvs.c @@ -99,7 +99,6 @@ __hn_nvs_execute(struct hn_data *hv, /* Silently drop received packets while waiting for response */ if (hdr->type == NVS_TYPE_RNDIS) { hn_nvs_ack_rxbuf(chan, xactid); - --hv->rxbuf_outstanding; goto retry; } diff --git a/drivers/net/netvsc/hn_rxtx.c b/drivers/net/netvsc/hn_rxtx.c index 6a52885d58..cc4ced37aa 100644 --- a/drivers/net/netvsc/hn_rxtx.c +++ b/drivers/net/netvsc/hn_rxtx.c @@ -519,24 +519,13 @@ next: return 0; } -/* - * Ack the consumed RXBUF associated w/ this channel packet, - * so that this RXBUF can be recycled by the hypervisor. - */ -static void hn_rx_buf_release(struct hn_rx_bufinfo *rxb) +static void hn_rx_buf_free_cb(void *buf __rte_unused, void *opaque) { - struct rte_mbuf_ext_shared_info *shinfo = &rxb->shinfo; + struct hn_rx_bufinfo *rxb = opaque; struct hn_data *hv = rxb->hv; - if (rte_mbuf_ext_refcnt_update(shinfo, -1) == 0) { - hn_nvs_ack_rxbuf(rxb->chan, rxb->xactid); - --hv->rxbuf_outstanding; - } -} - -static void hn_rx_buf_free_cb(void *buf __rte_unused, void *opaque) -{ - hn_rx_buf_release(opaque); + rte_atomic32_dec(&hv->rxbuf_outstanding); + hn_nvs_ack_rxbuf(rxb->chan, rxb->xactid); } static struct hn_rx_bufinfo *hn_rx_buf_init(const struct hn_rx_queue *rxq, @@ -576,7 +565,8 @@ static void hn_rxpkt(struct hn_rx_queue *rxq, struct hn_rx_bufinfo *rxb, * some space available in receive area for later packets. */ if (dlen >= HN_RXCOPY_THRESHOLD && - hv->rxbuf_outstanding < hv->rxbuf_section_cnt / 2) { + (uint32_t)rte_atomic32_read(&hv->rxbuf_outstanding) < + hv->rxbuf_section_cnt / 2) { struct rte_mbuf_ext_shared_info *shinfo; const void *rxbuf; rte_iova_t iova; @@ -590,8 +580,9 @@ static void hn_rxpkt(struct hn_rx_queue *rxq, struct hn_rx_bufinfo *rxb, iova = rte_mem_virt2iova(rxbuf) + RTE_PTR_DIFF(data, rxbuf); shinfo = &rxb->shinfo; - if (rte_mbuf_ext_refcnt_update(shinfo, 1) == 1) - ++hv->rxbuf_outstanding; + /* shinfo is already set to 1 by the caller */ + if (rte_mbuf_ext_refcnt_update(shinfo, 1) == 2) + rte_atomic32_inc(&hv->rxbuf_outstanding); rte_pktmbuf_attach_extbuf(m, data, iova, dlen + headroom, shinfo); @@ -832,7 +823,8 @@ hn_nvs_handle_rxbuf(struct rte_eth_dev *dev, } /* Send ACK now if external mbuf not used */ - hn_rx_buf_release(rxb); + if (rte_mbuf_ext_refcnt_update(&rxb->shinfo, -1) == 0) + hn_nvs_ack_rxbuf(rxb->chan, rxb->xactid); } /* diff --git a/drivers/net/netvsc/hn_var.h b/drivers/net/netvsc/hn_var.h index 881832d857..7cb7713e93 100644 --- a/drivers/net/netvsc/hn_var.h +++ b/drivers/net/netvsc/hn_var.h @@ -113,7 +113,7 @@ struct hn_data { struct rte_mem_resource *rxbuf_res; /* UIO resource for Rx */ struct hn_rx_bufinfo *rxbuf_info; uint32_t rxbuf_section_cnt; /* # of Rx sections */ - volatile uint32_t rxbuf_outstanding; + rte_atomic32_t rxbuf_outstanding; uint16_t max_queues; /* Max available queues */ uint16_t num_queues; uint64_t rss_offloads; -- 2.20.1