[dpdk-stable] patch 'net/enic: fix crash when freeing 0 packet to mempool' has been queued to LTS release 16.11.3

[John Daley (johndale)]

> -----Original Message-----
> From: Yuanhan Liu [mailto:yliu at fridaylinux.org]
> Sent: Tuesday, August 08, 2017 8:44 PM
> To: Aaron Conole <aconole at redhat.com>
> Cc: Vincent S . Cojot <vcojot at redhat.com>; John Daley (johndale)
> <johndale at cisco.com>; dpdk stable <stable at dpdk.org>; Yuanhan Liu
> <yliu at fridaylinux.org>
> Subject: patch 'net/enic: fix crash when freeing 0 packet to mempool' has
> been queued to LTS release 16.11.3
> 
> Hi,
> 
> FYI, your patch has been queued to LTS release 16.11.3
> 
> Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
> It will be pushed if I get no objections before 08/11/17. So please shout if
> anyone has objections.

Certainly no objections from me. When are you targeting 16.11.3 release?

Thanks,
Johnd
> 
> Thanks.
> 
> 	--yliu
> 
> ---
> From d471e9aabecec383a1e9187461ba88a70ce256cb Mon Sep 17 00:00:00
> 2001
> From: Aaron Conole <aconole at redhat.com>
> Date: Wed, 2 Aug 2017 14:02:13 -0400
> Subject: [PATCH] net/enic: fix crash when freeing 0 packet to mempool
> 
> [ upstream commit f7a58af502e08368a267886535367f205d4a5de6 ]
> 
> Occasionally, the amount of packets to free from the work queue ends
> perfectly on a boundary to have nb_free = 0 and pool = 0.  This causes a
> segfault as follows:
> 
>   (gdb) bt
>   #0  rte_mempool_default_cache
>   #1  rte_mempool_put_bulk (n=0, obj_table=0x7f10deff2530, mp=0x0)
>   #2  enic_free_wq_bufs (wq=wq at entry=0x7efabffcd5b0,
>       completed_index=completed_index at entry=33)
>   #3  0x00007f11e9c86e17 in enic_cleanup_wq (enic=<optimized out>,
>       wq=wq at entry=0x7efabffcd5b0)
>       at /usr/src/debug/openvswitch-2.6.1/dpdk-
> 16.11/drivers/net/enic/enic_rxtx.c:442
>   #4  0x00007f11e9c86e5f in enic_xmit_pkts (tx_queue=0x7efabffcd5b0,
>       tx_pkts=0x7f10deffb1a8, nb_pkts=<optimized out>)
>       at /usr/src/debug/openvswitch-2.6.1/dpdk-
> 16.11/drivers/net/enic/enic_rxtx.c:470
>   #5  0x00007f11e9e147ad in rte_eth_tx_burst (nb_pkts=<optimized out>,
>       tx_pkts=0x7f10deffb1a8, queue_id=0, port_id=<optimized out>)
> 
> This commit makes the enic wq driver match other drivers who call the bulk
> free, by checking that there are actual packets to free.
> 
> Fixes: 36935afbc53c ("net/enic: refactor Tx mbuf recycling")
> 
> Reported-by: Vincent S. Cojot <vcojot at redhat.com>
> Reported-at: https://bugzilla.redhat.com/show_bug.cgi?id=1468631
> Signed-off-by: Aaron Conole <aconole at redhat.com>
> Reviewed-by: John Daley <johndale at cisco.com>
> ---
>  drivers/net/enic/enic_rxtx.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/net/enic/enic_rxtx.c b/drivers/net/enic/enic_rxtx.c index
> 912ea15..1934f8b 100644
> --- a/drivers/net/enic/enic_rxtx.c
> +++ b/drivers/net/enic/enic_rxtx.c
> @@ -426,7 +426,8 @@ static inline void enic_free_wq_bufs(struct vnic_wq
> *wq, u16 completed_index)
>  		tail_idx = enic_ring_incr(desc_count, tail_idx);
>  	}
> 
> -	rte_mempool_put_bulk(pool, (void **)free, nb_free);
> +	if (nb_free > 0)
> +		rte_mempool_put_bulk(pool, (void **)free, nb_free);
> 
>  	wq->tail_idx = tail_idx;
>  	wq->ring.desc_avail += nb_to_free;
> --
> 2.7.4