[dpdk-stable] [dpdk-dev] [PATCH v4 3/5] net/tap: fix check for mbuf's nb_segs failure

[Ferruh Yigit]

On 4/11/2020 12:23 PM, wangyunjian wrote:
> From: Yunjian Wang <wangyunjian at huawei.com>
> 
> Now the rxq->pool is mbuf concatenation, but its nb_segs is 1. When
> conducting some sanity checks on the mbuf with debug enabled, it fails.
> 
> Fixes: 0781f5762cfe ("net/tap: support segmented mbufs")
> CC: stable at dpdk.org
> 
> Signed-off-by: Yunjian Wang <wangyunjian at huawei.com>
> ---
>  drivers/net/tap/rte_eth_tap.c | 21 +++++++++++++++++----
>  1 file changed, 17 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/net/tap/rte_eth_tap.c b/drivers/net/tap/rte_eth_tap.c
> index 0156d689d..6a77b2a7e 100644
> --- a/drivers/net/tap/rte_eth_tap.c
> +++ b/drivers/net/tap/rte_eth_tap.c
> @@ -339,6 +339,19 @@ tap_rx_offload_get_queue_capa(void)
>  	       DEV_RX_OFFLOAD_TCP_CKSUM;
>  }
>  
> +static void
> +tap_rxq_pool_free(struct rte_mbuf *pool)
> +{
> +	struct rte_mbuf *next;
> +
> +	while (pool) {
> +		next = pool->next;
> +		pool->next = NULL;
> +		rte_pktmbuf_free(pool);
> +		pool = next;
> +	}
> +}

I am aware I have suggested this but I have missed that 'rte_mbuf_check()' still
may fail.

The 'rxq->pool' is a set of linked mbufs, each mbuf->next points to next one.
But all mbufs in the pool has 'nb_segs' as '1'. As far as I can see from code
this will cause a warning in 'rte_mbuf_check()'. If you can reproduce it you can
double check.

Your initial implementation seems the correct one, to fix the nb_segs for first
mbuf in the pool, sorry for the noise.

> +
>  /* Callback to handle the rx burst of packets to the correct interface and
>   * file descriptor(s) in a multi-queue setup.
>   */
> @@ -389,7 +402,7 @@ pmd_rx_burst(void *queue, struct rte_mbuf **bufs, uint16_t nb_pkts)
>  					goto end;
>  
>  				seg->next = NULL;
> -				rte_pktmbuf_free(mbuf);
> +				tap_rxq_pool_free(mbuf);
>  
>  				goto end;
>  			}
> @@ -1038,7 +1051,7 @@ tap_dev_close(struct rte_eth_dev *dev)
>  			rxq = &internals->rxq[i];
>  			close(process_private->rxq_fds[i]);
>  			process_private->rxq_fds[i] = -1;
> -			rte_pktmbuf_free(rxq->pool);
> +			tap_rxq_pool_free(rxq->pool);
>  			rte_free(rxq->iovecs);
>  			rxq->pool = NULL;
>  			rxq->iovecs = NULL;
> @@ -1077,7 +1090,7 @@ tap_rx_queue_release(void *queue)
>  	if (process_private->rxq_fds[rxq->queue_id] > 0) {
>  		close(process_private->rxq_fds[rxq->queue_id]);
>  		process_private->rxq_fds[rxq->queue_id] = -1;
> -		rte_pktmbuf_free(rxq->pool);
> +		tap_rxq_pool_free(rxq->pool);
>  		rte_free(rxq->iovecs);
>  		rxq->pool = NULL;
>  		rxq->iovecs = NULL;
> @@ -1485,7 +1498,7 @@ tap_rx_queue_setup(struct rte_eth_dev *dev,
>  	return 0;
>  
>  error:
> -	rte_pktmbuf_free(rxq->pool);
> +	tap_rxq_pool_free(rxq->pool);
>  	rxq->pool = NULL;
>  	rte_free(rxq->iovecs);
>  	rxq->iovecs = NULL;
>