From mboxrd@z Thu Jan 1 00:00:00 1970 From: =?iso-8859-1?Q?N=E9lio?= Laranjeiro Subject: Re: [PATCH] net/mlx5: fix crash on deleting flow drop queue Date: Tue, 2 May 2017 08:45:15 +0200 Message-ID: <20170502064515.GE31330@autoinstall.dev.6wind.com> References: <20170501210542.5032-1-yskoh@mellanox.com> Mime-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Transfer-Encoding: 8bit Cc: ferruh.yigit@intel.com, dev@dpdk.org, adrien.mazarguil@6wind.com To: Yongseok Koh Return-path: Received: from mail-wm0-f52.google.com (mail-wm0-f52.google.com [74.125.82.52]) by dpdk.org (Postfix) with ESMTP id 0E804374F for ; Tue, 2 May 2017 08:45:23 +0200 (CEST) Received: by mail-wm0-f52.google.com with SMTP id n198so11754395wmg.0 for ; Mon, 01 May 2017 23:45:22 -0700 (PDT) Content-Disposition: inline In-Reply-To: <20170501210542.5032-1-yskoh@mellanox.com> List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org Sender: "dev" On Mon, May 01, 2017 at 02:05:42PM -0700, Yongseok Koh wrote: > If mlx5_dev_start() fails, it tries to rollback data structures related to > rte_flow including drop queue. The destruction code doesn't assume the > structures are created but priv_flow_delete_drop_queue() never does sanity > check. This can cause a crash. > > Fixes: 028761059aeb ("net/mlx5: use an RSS drop queue") > > Signed-off-by: Yongseok Koh > --- > drivers/net/mlx5/mlx5_flow.c | 15 ++++++++++----- > 1 file changed, 10 insertions(+), 5 deletions(-) > > diff --git a/drivers/net/mlx5/mlx5_flow.c b/drivers/net/mlx5/mlx5_flow.c > index cd3e5daf3..adcbe3f52 100644 > --- a/drivers/net/mlx5/mlx5_flow.c > +++ b/drivers/net/mlx5/mlx5_flow.c > @@ -1465,13 +1465,18 @@ priv_flow_delete_drop_queue(struct priv *priv) > struct rte_flow_drop *fdq = priv->flow_drop_queue; > unsigned int i; > > - claim_zero(ibv_destroy_qp(fdq->qp)); > - claim_zero(ibv_exp_destroy_rwq_ind_table(fdq->ind_table)); > + if (!fdq) > + return; > + if (fdq->qp) > + claim_zero(ibv_destroy_qp(fdq->qp)); > + if (fdq->ind_table) > + claim_zero(ibv_exp_destroy_rwq_ind_table(fdq->ind_table)); > for (i = 0; i != MLX5_DROP_WQ_N; ++i) { > - assert(fdq->wqs[i]); > - claim_zero(ibv_exp_destroy_wq(fdq->wqs[i])); > + if (fdq->wqs[i]) > + claim_zero(ibv_exp_destroy_wq(fdq->wqs[i])); > } > - claim_zero(ibv_destroy_cq(fdq->cq)); > + if (fdq->cq) > + claim_zero(ibv_destroy_cq(fdq->cq)); > rte_free(fdq); > priv->flow_drop_queue = NULL; > } > -- > 2.11.0 Acked-by: Nelio Laranjeiro -- Nélio Laranjeiro 6WIND