[dpdk-stable] patch 'kni: fix crash caused by freeing mempool' has been queued to LTS release 16.11.2

[Yuanhan Liu]

Hi,

FYI, your patch has been queued to LTS release 16.11.2

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable
yet. It will be pushed if I get no objections before 05/13/17.
So please shout if anyone has objections.

Thanks.

	--yliu

---
>From 02b8ce63972bc7f12a73131941dfb9aacdc57f11 Mon Sep 17 00:00:00 2001
From: Ferruh Yigit <ferruh.yigit at intel.com>
Date: Wed, 3 May 2017 17:10:37 +0100
Subject: [PATCH] kni: fix crash caused by freeing mempool

[ upstream commit 57a484e08a7ef3dea2018157d518b01a891ddfca ]

To clean alloc_q, which has physical addresses of the mbufs, kni lib
free the pkt_mempool, but this leads a crash in kni unit test.

KNI library shouldn't free the pkt_mempool.

Implementation updated to find the mbufs in the alloc_q and return them
back to mempool.

Fixes: 8eba5ebd1811 ("kni: fix possible memory leak")

Signed-off-by: Ferruh Yigit <ferruh.yigit at intel.com>
---
 lib/librte_kni/rte_kni.c | 34 ++++++++++++++++++++++------------
 1 file changed, 22 insertions(+), 12 deletions(-)

diff --git a/lib/librte_kni/rte_kni.c b/lib/librte_kni/rte_kni.c
index 52fcd4b..c3f9208 100644
--- a/lib/librte_kni/rte_kni.c
+++ b/lib/librte_kni/rte_kni.c
@@ -451,17 +451,35 @@ kni_free_fifo(struct rte_kni_fifo *fifo)
 	} while (ret);
 }
 
+static void *
+va2pa(struct rte_mbuf *m)
+{
+	return (void *)((unsigned long)m -
+			((unsigned long)m->buf_addr -
+			 (unsigned long)m->buf_physaddr));
+}
+
 static void
-kni_free_fifo_phy(struct rte_mempool *pktmbuf_pool, struct rte_kni_fifo *fifo)
+obj_free(struct rte_mempool *mp __rte_unused, void *opaque, void *obj,
+		unsigned obj_idx __rte_unused)
+{
+	struct rte_mbuf *m = obj;
+	void *mbuf_phys = opaque;
+
+	if (va2pa(m) == mbuf_phys)
+		rte_pktmbuf_free(m);
+}
+
+static void
+kni_free_fifo_phy(struct rte_mempool *mp, struct rte_kni_fifo *fifo)
 {
 	void *mbuf_phys;
 	int ret;
 
-	rte_mempool_free(pktmbuf_pool);
-
-	/* All mbufs alredy freed with rte_mempoll_free, just free the fifo */
 	do {
 		ret = kni_fifo_get(fifo, &mbuf_phys, 1);
+		if (ret)
+			rte_mempool_obj_iter(mp, obj_free, mbuf_phys);
 	} while (ret);
 }
 
@@ -557,14 +575,6 @@ rte_kni_handle_request(struct rte_kni *kni)
 	return 0;
 }
 
-static void *
-va2pa(struct rte_mbuf *m)
-{
-	return (void *)((unsigned long)m -
-			((unsigned long)m->buf_addr -
-			 (unsigned long)m->buf_physaddr));
-}
-
 unsigned
 rte_kni_tx_burst(struct rte_kni *kni, struct rte_mbuf **mbufs, unsigned num)
 {
-- 
1.9.0