[PATCHv2 0/4] fix for 2 consecutive rte_eth_dev_start() can cause a SIGSEGV

[PATCHv2 0/4] fix for 2 consecutive rte_eth_dev_start() can cause a SIGSEGV

[Konstantin Ananyev]

Konstantin Ananyev (4):
  e1000: do not release queue on alloc error
  igb/ixgbe: reset queue pointers after releasing
  ethdev: fix compiler warning on PMD_DEBUG_TRACE formats
  ethdev: prevent from starting/stopping already started/stopped

v2 changes:
  Split one patch into series of 4.

 lib/librte_ether/rte_ethdev.c     | 29 ++++++++++++++++++++++++-----
 lib/librte_pmd_e1000/em_rxtx.c    |  1 -
 lib/librte_pmd_e1000/igb_rxtx.c   |  5 +++--
 lib/librte_pmd_ixgbe/ixgbe_rxtx.c |  8 ++++++--
 4 files changed, 33 insertions(+), 10 deletions(-)

-- 
1.8.3.1

[PATCHv2 1/4] e1000: do not release queue on alloc error

[Konstantin Ananyev]

If igb_alloc_rx_queue_mbufs() would fail to allocate an mbuf for RX queue,
it calls igb_rx_queue_release(rxq).
That causes rxq to be silently freed, without updating
dev->data->rx_queues[].
So any further reference to it will trigger the SIGSEGV.
Same thing in em PMD too.

To fix: igb_alloc_rx_queue_mbufs() should just return an error to the
caller and let upper layer to deal with the probem.
That's what ixgbe PMD is doing right now.

Signed-off-by: Konstantin Ananyev <konstantin.ananyev-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org>
---
 lib/librte_pmd_e1000/em_rxtx.c  | 1 -
 lib/librte_pmd_e1000/igb_rxtx.c | 1 -
 2 files changed, 2 deletions(-)

diff --git a/lib/librte_pmd_e1000/em_rxtx.c b/lib/librte_pmd_e1000/em_rxtx.c
index 4f98a3f..5ed4def 100644
--- a/lib/librte_pmd_e1000/em_rxtx.c
+++ b/lib/librte_pmd_e1000/em_rxtx.c
@@ -1580,7 +1580,6 @@ em_alloc_rx_queue_mbufs(struct em_rx_queue *rxq)
 		if (mbuf == NULL) {
 			PMD_INIT_LOG(ERR, "RX mbuf alloc failed "
 				"queue_id=%hu\n", rxq->queue_id);
-			em_rx_queue_release(rxq);
 			return (-ENOMEM);
 		}
 
diff --git a/lib/librte_pmd_e1000/igb_rxtx.c b/lib/librte_pmd_e1000/igb_rxtx.c
index ae53428..e35649f 100644
--- a/lib/librte_pmd_e1000/igb_rxtx.c
+++ b/lib/librte_pmd_e1000/igb_rxtx.c
@@ -1818,7 +1818,6 @@ igb_alloc_rx_queue_mbufs(struct igb_rx_queue *rxq)
 		if (mbuf == NULL) {
 			PMD_INIT_LOG(ERR, "RX mbuf alloc failed "
 				"queue_id=%hu\n", rxq->queue_id);
-			igb_rx_queue_release(rxq);
 			return (-ENOMEM);
 		}
 		dma_addr =
-- 
1.8.3.1

[PATCHv2 2/4] igb/ixgbe: reset queue pointers after releasing

[Konstantin Ananyev]

Signed-off-by: Konstantin Ananyev <konstantin.ananyev-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org>
---
 lib/librte_pmd_e1000/igb_rxtx.c   | 4 +++-
 lib/librte_pmd_ixgbe/ixgbe_rxtx.c | 8 ++++++--
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/lib/librte_pmd_e1000/igb_rxtx.c b/lib/librte_pmd_e1000/igb_rxtx.c
index e35649f..712086a 100644
--- a/lib/librte_pmd_e1000/igb_rxtx.c
+++ b/lib/librte_pmd_e1000/igb_rxtx.c
@@ -1212,8 +1212,10 @@ eth_igb_tx_queue_setup(struct rte_eth_dev *dev,
 			"the TX WTHRESH value to 4, 8, or 16.\n");
 
 	/* Free memory prior to re-allocation if needed */
-	if (dev->data->tx_queues[queue_idx] != NULL)
+	if (dev->data->tx_queues[queue_idx] != NULL) {
 		igb_tx_queue_release(dev->data->tx_queues[queue_idx]);
+		dev->data->tx_queues[queue_idx] = NULL;
+	}
 
 	/* First allocate the tx queue data structure */
 	txq = rte_zmalloc("ethdev TX queue", sizeof(struct igb_tx_queue),
diff --git a/lib/librte_pmd_ixgbe/ixgbe_rxtx.c b/lib/librte_pmd_ixgbe/ixgbe_rxtx.c
index dc79c4b..99584b0 100644
--- a/lib/librte_pmd_ixgbe/ixgbe_rxtx.c
+++ b/lib/librte_pmd_ixgbe/ixgbe_rxtx.c
@@ -1802,8 +1802,10 @@ ixgbe_dev_tx_queue_setup(struct rte_eth_dev *dev,
 	}
 
 	/* Free memory prior to re-allocation if needed... */
-	if (dev->data->tx_queues[queue_idx] != NULL)
+	if (dev->data->tx_queues[queue_idx] != NULL) {
 		ixgbe_tx_queue_release(dev->data->tx_queues[queue_idx]);
+		dev->data->tx_queues[queue_idx] = NULL;
+	}
 
 	/* First allocate the tx queue data structure */
 	txq = rte_zmalloc_socket("ethdev TX queue", sizeof(struct igb_tx_queue),
@@ -2061,8 +2063,10 @@ ixgbe_dev_rx_queue_setup(struct rte_eth_dev *dev,
 	}
 
 	/* Free memory prior to re-allocation if needed... */
-	if (dev->data->rx_queues[queue_idx] != NULL)
+	if (dev->data->rx_queues[queue_idx] != NULL) {
 		ixgbe_rx_queue_release(dev->data->rx_queues[queue_idx]);
+		dev->data->rx_queues[queue_idx] = NULL;
+	}
 
 	/* First allocate the rx queue data structure */
 	rxq = rte_zmalloc_socket("ethdev RX queue", sizeof(struct igb_rx_queue),
-- 
1.8.3.1

[PATCHv2 3/4] ethdev: prevent from starting/stopping already started/stopped device

[Konstantin Ananyev]

From: Konstantin Ananyev <konstantin.ananyev-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org>

Signed-off-by: Konstantin Ananyev <konstantin.ananyev-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org>
---
 lib/librte_ether/rte_ethdev.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/lib/librte_ether/rte_ethdev.c b/lib/librte_ether/rte_ethdev.c
index 11e877b..47bcee1 100644
--- a/lib/librte_ether/rte_ethdev.c
+++ b/lib/librte_ether/rte_ethdev.c
@@ -764,6 +764,14 @@ rte_eth_dev_start(uint8_t port_id)
 	dev = &rte_eth_devices[port_id];
 
 	FUNC_PTR_OR_ERR_RET(*dev->dev_ops->dev_start, -ENOTSUP);
+
+	if (dev->data->dev_started != 0) {
+		PMD_DEBUG_TRACE("Device with port_id=%" PRIu8
+			" already started\n",
+			port_id);
+		return (0);
+	}
+
 	diag = (*dev->dev_ops->dev_start)(dev);
 	if (diag == 0)
 		dev->data->dev_started = 1;
@@ -791,6 +799,14 @@ rte_eth_dev_stop(uint8_t port_id)
 	dev = &rte_eth_devices[port_id];
 
 	FUNC_PTR_OR_RET(*dev->dev_ops->dev_stop);
+
+	if (dev->data->dev_started == 0) {
+		PMD_DEBUG_TRACE("Device with port_id=%" PRIu8
+			" already stopped\n",
+			port_id);
+		return;
+	}
+
 	dev->data->dev_started = 0;
 	(*dev->dev_ops->dev_stop)(dev);
 }
-- 
1.8.3.1

[PATCHv2 4/4] ethdev: fix compiler warning on PMD_DEBUG_TRACE formats

[Konstantin Ananyev]

icc 12.1 complains about RTE_LOG() format:
"argument is incompatible with corresponding format string conversion"

Signed-off-by: Konstantin Ananyev <konstantin.ananyev-ral2JQCrhuEAvxtiuMwx3w@public.gmane.org>
---
 lib/librte_ether/rte_ethdev.c | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/lib/librte_ether/rte_ethdev.c b/lib/librte_ether/rte_ethdev.c
index 47bcee1..301ff61 100644
--- a/lib/librte_ether/rte_ethdev.c
+++ b/lib/librte_ether/rte_ethdev.c
@@ -447,7 +447,8 @@ rte_eth_dev_check_mq_mode(uint8_t port_id, uint16_t nb_rx_q, uint16_t nb_tx_q,
 		    (dev_conf->rxmode.mq_mode == ETH_MQ_RX_DCB_RSS) ||
 		    (dev_conf->txmode.mq_mode == ETH_MQ_TX_DCB)) {
 			/* SRIOV only works in VMDq enable mode */
-			PMD_DEBUG_TRACE("ethdev port_id=%hhu SRIOV active, "
+			PMD_DEBUG_TRACE("ethdev port_id=%" PRIu8
+					" SRIOV active, "
 					"wrong VMDQ mq_mode rx %u tx %u\n", 
 					port_id,
 					dev_conf->rxmode.mq_mode,
@@ -460,7 +461,8 @@ rte_eth_dev_check_mq_mode(uint8_t port_id, uint16_t nb_rx_q, uint16_t nb_tx_q,
 		case ETH_MQ_RX_VMDQ_DCB:
 		case ETH_MQ_RX_VMDQ_DCB_RSS:
 			/* DCB/RSS VMDQ in SRIOV mode, not implement yet */
-			PMD_DEBUG_TRACE("ethdev port_id=%hhu SRIOV active, "
+			PMD_DEBUG_TRACE("ethdev port_id=%" PRIu8
+					" SRIOV active, "
 					"unsupported VMDQ mq_mode rx %u\n", 
 					port_id, dev_conf->rxmode.mq_mode);
 			return (-EINVAL);
@@ -475,7 +477,8 @@ rte_eth_dev_check_mq_mode(uint8_t port_id, uint16_t nb_rx_q, uint16_t nb_tx_q,
 		switch (dev_conf->txmode.mq_mode) {
 		case ETH_MQ_TX_VMDQ_DCB:
 			/* DCB VMDQ in SRIOV mode, not implement yet */
-			PMD_DEBUG_TRACE("ethdev port_id=%hhu SRIOV active, "
+			PMD_DEBUG_TRACE("ethdev port_id=%" PRIu8
+					" SRIOV active, "
 					"unsupported VMDQ mq_mode tx %u\n", 
 					port_id, dev_conf->txmode.mq_mode);
 			return (-EINVAL);
@@ -758,7 +761,7 @@ rte_eth_dev_start(uint8_t port_id)
 	PROC_PRIMARY_OR_ERR_RET(-E_RTE_SECONDARY);
 
 	if (port_id >= nb_ports) {
-		PMD_DEBUG_TRACE("Invalid port_id=%d\n", port_id);
+		PMD_DEBUG_TRACE("Invalid port_id=%" PRIu8 "\n", port_id);
 		return (-EINVAL);
 	}
 	dev = &rte_eth_devices[port_id];
@@ -793,7 +796,7 @@ rte_eth_dev_stop(uint8_t port_id)
 	PROC_PRIMARY_OR_RET();
 
 	if (port_id >= nb_ports) {
-		PMD_DEBUG_TRACE("Invalid port_id=%d\n", port_id);
+		PMD_DEBUG_TRACE("Invalid port_id=%" PRIu8 "\n", port_id);
 		return;
 	}
 	dev = &rte_eth_devices[port_id];
-- 
1.8.3.1

Re: [PATCHv2 0/4] fix for 2 consecutive rte_eth_dev_start() can cause a SIGSEGV

[Thomas Monjalon]

> Konstantin Ananyev (4):
>   e1000: do not release queue on alloc error
>   igb/ixgbe: reset queue pointers after releasing
>   ethdev: fix compiler warning on PMD_DEBUG_TRACE formats
>   ethdev: prevent from starting/stopping already started/stopped

Acked-by: Thomas Monjalon <thomas.monjalon-pdR9zngts4EAvxtiuMwx3w@public.gmane.org>

Applied for version 1.7.0.

Thanks
-- 
Thomas