[dpdk-stable] patch 'vhost: fix dequeue zero copy' has been queued to LTS release 16.11.2

[Yuanhan Liu]

Hi,

FYI, your patch has been queued to LTS release 16.11.2

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable
yet. It will be pushed if I get no objections before 04/26/17.
So please shout if anyone has objections.

Thanks.

	--yliu

---
>From 0b107b3d6023fb690a7dbd3e500a87807cfa9060 Mon Sep 17 00:00:00 2001
From: Yuanhan Liu <yuanhan.liu at linux.intel.com>
Date: Wed, 19 Apr 2017 13:26:01 +0800
Subject: [PATCH] vhost: fix dequeue zero copy

[ upstream commit 84ad6e44915a797cbab81c3042c600955ca75408 ]

For zero copy mode, we need pin the mbuf to not let the underlaying PMD
driver (or the app) free the mbuf. Currently, only the heading mbuf is
pinned. However, the mbuf free function would try to free all mbufs
in the mbuf chain (-1 to the refcnt). This may lead the head mbuf being
still pinned, while the other subsequent mbufs are actually freed. Which
is wrong.

It becomes more fatal after the mbuf refactor, more specificly, after
the commit 8f094a9ac5d7 ("mbuf: set mbuf fields while in pool"). The
refcnt resets to 1 after the last real reference. OTOH, it leads to a
situtation that we never know one mbuf is actually freed or not. This
would result the mbuf __just__ after the heading mbuf being freed twice:
it's firstly freed (and put back to mempool) when the underlaying PMD
finishes the DMA.  Later, it will then be freed again when vhost unpins
it. Meaning, one mbuf may be returned to the mempool twice, while in
turn, being allocated twice later. Something uncertain may happen then.
For example, the VM2VM case becomes broken.

Fixes: b0a985d1f340 ("vhost: add dequeue zero copy")

Signed-off-by: Yuanhan Liu <yuanhan.liu at linux.intel.com>
---
 lib/librte_vhost/virtio_net.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/lib/librte_vhost/virtio_net.c b/lib/librte_vhost/virtio_net.c
index d0a3b11..ea027f1 100644
--- a/lib/librte_vhost/virtio_net.c
+++ b/lib/librte_vhost/virtio_net.c
@@ -905,6 +905,8 @@ copy_desc_to_mbuf(struct virtio_net *dev, struct vring_desc *descs,
 					"allocate memory for mbuf.\n");
 				return -1;
 			}
+			if (unlikely(dev->dequeue_zero_copy))
+				rte_mbuf_refcnt_update(cur, 1);
 
 			prev->next = cur;
 			prev->data_len = mbuf_offset;
-- 
1.9.0