[dpdk-stable] patch 'net/mlx4: fix buffer leakage on device close' has been queued to stable release 19.11.9

[Christian Ehrhardt]

Hi,

FYI, your patch has been queued to stable release 19.11.9

Note it hasn't been pushed to http://dpdk.org/browse/dpdk-stable yet.
It will be pushed if I get no objections before 05/19/21. So please
shout if anyone has objections.

Also note that after the patch there's a diff of the upstream commit vs the
patch applied to the branch. This will indicate if there was any rebasing
needed to apply to the stable branch. If there were code changes for rebasing
(ie: not only metadata diffs), please double check that the rebase was
correctly done.

Queued patches are on a temporary branch at:
https://github.com/cpaelzer/dpdk-stable-queue

This queued commit can be viewed at:
https://github.com/cpaelzer/dpdk-stable-queue/commit/11b2ebc02eb9514fcb75251ed7a25ad8170d77c9

Thanks.

Christian Ehrhardt <christian.ehrhardt at canonical.com>

---
>From 11b2ebc02eb9514fcb75251ed7a25ad8170d77c9 Mon Sep 17 00:00:00 2001
From: Viacheslav Ovsiienko <viacheslavo at nvidia.com>
Date: Sat, 17 Apr 2021 20:14:14 +0300
Subject: [PATCH] net/mlx4: fix buffer leakage on device close

[ upstream commit b014c6b7b595277860308468c4c12a9337bf132e ]

The mlx4 PMD tracks the buffers (mbufs) for the packets being
transmitted in the dedicated array named as "elts". The tx_burst
routine frees the mbufs from this array once it needs to rearm
the hardware descriptor and store the new mbuf, so it looks
like as replacement mbuf pointer in the elts array.

On the device stop mlx4 PMD freed only the part of elts according
tail and head pointers, leaking the rest of buffers, remained in
the elts array.

Fixes: a2ce2121c01c ("net/mlx4: separate Tx configuration functions")

Signed-off-by: Viacheslav Ovsiienko <viacheslavo at nvidia.com>
---
 drivers/net/mlx4/mlx4_rxtx.c |  4 ----
 drivers/net/mlx4/mlx4_txq.c  | 19 +++++++++----------
 2 files changed, 9 insertions(+), 14 deletions(-)

diff --git a/drivers/net/mlx4/mlx4_rxtx.c b/drivers/net/mlx4/mlx4_rxtx.c
index 4dc0adb938..3c1eea3af7 100644
--- a/drivers/net/mlx4/mlx4_rxtx.c
+++ b/drivers/net/mlx4/mlx4_rxtx.c
@@ -922,10 +922,6 @@ mlx4_tx_burst(void *dpdk_txq, struct rte_mbuf **pkts, uint16_t pkts_n)
 		if (likely(elt->buf != NULL)) {
 			struct rte_mbuf *tmp = elt->buf;
 
-#ifndef NDEBUG
-			/* Poisoning. */
-			memset(&elt->buf, 0x66, sizeof(struct rte_mbuf *));
-#endif
 			/* Faster than rte_pktmbuf_free(). */
 			do {
 				struct rte_mbuf *next = tmp->next;
diff --git a/drivers/net/mlx4/mlx4_txq.c b/drivers/net/mlx4/mlx4_txq.c
index 824ddbd827..8559eaf82c 100644
--- a/drivers/net/mlx4/mlx4_txq.c
+++ b/drivers/net/mlx4/mlx4_txq.c
@@ -207,19 +207,18 @@ mlx4_tx_uar_uninit_secondary(struct rte_eth_dev *dev __rte_unused)
 static void
 mlx4_txq_free_elts(struct txq *txq)
 {
-	unsigned int elts_head = txq->elts_head;
-	unsigned int elts_tail = txq->elts_tail;
 	struct txq_elt (*elts)[txq->elts_n] = txq->elts;
-	unsigned int elts_m = txq->elts_n - 1;
+	unsigned int n = txq->elts_n;
 
-	DEBUG("%p: freeing WRs", (void *)txq);
-	while (elts_tail != elts_head) {
-		struct txq_elt *elt = &(*elts)[elts_tail++ & elts_m];
+	DEBUG("%p: freeing WRs, %u", (void *)txq, n);
+	while (n--) {
+		struct txq_elt *elt = &(*elts)[n];
 
-		assert(elt->buf != NULL);
-		rte_pktmbuf_free(elt->buf);
-		elt->buf = NULL;
-		elt->wqe = NULL;
+		if (elt->buf) {
+			rte_pktmbuf_free(elt->buf);
+			elt->buf = NULL;
+			elt->wqe = NULL;
+		}
 	}
 	txq->elts_tail = txq->elts_head;
 }
-- 
2.31.1

---
  Diff of the applied patch vs upstream commit (please double-check if non-empty:
---
--- -	2021-05-17 17:40:36.241421708 +0200
+++ 0175-net-mlx4-fix-buffer-leakage-on-device-close.patch	2021-05-17 17:40:29.503812091 +0200
@@ -1 +1 @@
-From b014c6b7b595277860308468c4c12a9337bf132e Mon Sep 17 00:00:00 2001
+From 11b2ebc02eb9514fcb75251ed7a25ad8170d77c9 Mon Sep 17 00:00:00 2001
@@ -5,0 +6,2 @@
+[ upstream commit b014c6b7b595277860308468c4c12a9337bf132e ]
+
@@ -17 +18,0 @@
-Cc: stable at dpdk.org
@@ -26 +27 @@
-index adc1c9bf81..ecf08f53cf 100644
+index 4dc0adb938..3c1eea3af7 100644
@@ -29 +30 @@
-@@ -921,10 +921,6 @@ mlx4_tx_burst(void *dpdk_txq, struct rte_mbuf **pkts, uint16_t pkts_n)
+@@ -922,10 +922,6 @@ mlx4_tx_burst(void *dpdk_txq, struct rte_mbuf **pkts, uint16_t pkts_n)
@@ -33 +34 @@
--#ifdef RTE_LIBRTE_MLX4_DEBUG
+-#ifndef NDEBUG
@@ -41 +42 @@
-index 31ab308050..2df26842fb 100644
+index 824ddbd827..8559eaf82c 100644
@@ -44 +45 @@
-@@ -206,19 +206,18 @@ mlx4_tx_uar_uninit_secondary(struct rte_eth_dev *dev __rte_unused)
+@@ -207,19 +207,18 @@ mlx4_tx_uar_uninit_secondary(struct rte_eth_dev *dev __rte_unused)
@@ -61 +62 @@
--		MLX4_ASSERT(elt->buf != NULL);
+-		assert(elt->buf != NULL);