From fc048bd52cb7e3382da86629a5aef89f1377aca8 Mon Sep 17 00:00:00 2001 From: Yongseok Koh Date: Thu, 5 Oct 2017 14:37:29 -0700 Subject: [PATCH] net/mlx5: fix overflow of Rx SW ring If vectorized Rx burst is short of mbufs in replenishment, Rx SW ring can overflow as the Rx burst handles 4 packets in a loop. This is because the function fills SW ring and its mbufs first and checks validity of each completion later. So, there should be some buffer slots at the tail of the ring to protect mbufs which are already owned by application. Fixes: 6cb559d67b83 ("net/mlx5: add vectorized Rx/Tx burst for x86") Cc: stable@dpdk.org Reported-by: Martin Weiser Signed-off-by: Yongseok Koh --- drivers/net/mlx5/mlx5_rxtx_vec_sse.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/drivers/net/mlx5/mlx5_rxtx_vec_sse.c b/drivers/net/mlx5/mlx5_rxtx_vec_sse.c index 33988e3335..075dce9087 100644 --- a/drivers/net/mlx5/mlx5_rxtx_vec_sse.c +++ b/drivers/net/mlx5/mlx5_rxtx_vec_sse.c @@ -638,6 +638,13 @@ rxq_cq_decompress_v(struct rxq *rxq, offsetof(struct rte_mbuf, rx_descriptor_fields1) + 8); RTE_BUILD_BUG_ON(offsetof(struct rte_mbuf, hash) != offsetof(struct rte_mbuf, rx_descriptor_fields1) + 12); + /* + * Not to overflow elts array. Decompress next time after mbuf + * replenishment. + */ + if (unlikely(mcqe_n + MLX5_VPMD_DESCS_PER_LOOP > + (uint16_t)(rxq->rq_ci - rxq->cq_ci))) + return; /* * A. load mCQEs into a 128bit register. * B. store rearm data to mbuf. @@ -1028,8 +1035,10 @@ rxq_burst_v(struct rxq *rxq, struct rte_mbuf **pkts, uint16_t pkts_n) } elts_idx = rxq->rq_pi & q_mask; elts = &(*rxq->elts)[elts_idx]; - /* Not to overflow pkts array. */ - pkts_n = RTE_ALIGN_FLOOR(pkts_n - rcvd_pkt, MLX5_VPMD_DESCS_PER_LOOP); + pkts_n = RTE_MIN(pkts_n - rcvd_pkt, + (uint16_t)(rxq->rq_ci - rxq->cq_ci)); + /* Not to overflow pkts/elts array. */ + pkts_n = RTE_ALIGN_FLOOR(pkts_n, MLX5_VPMD_DESCS_PER_LOOP); /* Not to cross queue end. */ pkts_n = RTE_MIN(pkts_n, q_n - elts_idx); if (!pkts_n) -- 2.20.1