From mboxrd@z Thu Jan  1 00:00:00 1970
From: Tiwei Bie <tiwei.bie@intel.com>
Subject: Re: [PATCH] vhost: fix zmbufs array leak after NUMA
	realloc
Date: Thu, 16 Aug 2018 13:31:08 +0800
Message-ID: <20180816053108.GA8252@debian>
References: <CGME20180815145341eucas1p15832e119a9d6f3fc54796675a283c44f@eucas1p1.samsung.com>
 <20180815145439.2513-1-i.maximets@samsung.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=utf-8
Cc: dev@dpdk.org, Maxime Coquelin <maxime.coquelin@redhat.com>,
 Zhihong Wang <zhihong.wang@intel.com>,
 Junjie Chen <junjie.j.chen@intel.com>, stable@dpdk.org
To: Ilya Maximets <i.maximets@samsung.com>
Return-path: <dev-bounces@dpdk.org>
Content-Disposition: inline
In-Reply-To: <20180815145439.2513-1-i.maximets@samsung.com>
List-Id: DPDK patches and discussions <dev.dpdk.org>
List-Unsubscribe: <https://mails.dpdk.org/options/dev>,
 <mailto:dev-request@dpdk.org?subject=unsubscribe>
List-Archive: <http://mails.dpdk.org/archives/dev/>
List-Post: <mailto:dev@dpdk.org>
List-Help: <mailto:dev-request@dpdk.org?subject=help>
List-Subscribe: <https://mails.dpdk.org/listinfo/dev>,
 <mailto:dev-request@dpdk.org?subject=subscribe>
Errors-To: dev-bounces@dpdk.org
Sender: "dev" <dev-bounces@dpdk.org>

On Wed, Aug 15, 2018 at 05:54:39PM +0300, Ilya Maximets wrote:
> 'numa_realloc()' allocates 'zmbufs' even if zero copy mode
> is not configured. This leads to memory leak, because array
> is freed only for zero copy case.
> 
> Fixes: 2651726defb7 ("vhost: do deep copy while reallocating queue")
> CC: stable@dpdk.org
> 
> Signed-off-by: Ilya Maximets <i.maximets@samsung.com>
> ---
>  lib/librte_vhost/vhost_user.c | 12 +++++++-----
>  1 file changed, 7 insertions(+), 5 deletions(-)
> 
> diff --git a/lib/librte_vhost/vhost_user.c b/lib/librte_vhost/vhost_user.c
> index a2d4c9ffc..9aa1ce118 100644
> --- a/lib/librte_vhost/vhost_user.c
> +++ b/lib/librte_vhost/vhost_user.c
> @@ -357,11 +357,13 @@ numa_realloc(struct virtio_net *dev, int index)
>  		memcpy(vq, old_vq, sizeof(*vq));
>  		TAILQ_INIT(&vq->zmbuf_list);
>  
> -		new_zmbuf = rte_malloc_socket(NULL, vq->zmbuf_size *
> -			sizeof(struct zcopy_mbuf), 0, newnode);
> -		if (new_zmbuf) {
> -			rte_free(vq->zmbufs);
> -			vq->zmbufs = new_zmbuf;
> +		if (dev->dequeue_zero_copy) {
> +			new_zmbuf = rte_malloc_socket(NULL, vq->zmbuf_size *
> +					sizeof(struct zcopy_mbuf), 0, newnode);
> +			if (new_zmbuf) {
> +				rte_free(vq->zmbufs);
> +				vq->zmbufs = new_zmbuf;
> +			}
>  		}
>  
>  		if (vq_is_packed(dev)) {
> -- 
> 2.17.1
> 

Reviewed-by: Tiwei Bie <tiwei.bie@intel.com>

Thanks!