* [PATCH 0/3] net/iavf: fix TM hierarchy commit and TM ops without QoS
@ 2026-10-14 12:24 Dawid Wesierski
2026-10-14 12:24 ` [PATCH 1/3] net/iavf: fix invalid free of queue TC map Dawid Wesierski
` (2 more replies)
0 siblings, 3 replies; 6+ messages in thread
From: Dawid Wesierski @ 2026-10-14 12:24 UTC (permalink / raw)
To: dev; +Cc: vladimir.medvedkin, bruce.richardson, anatoly.burakov,
marek.kasiewicz
Three fixes in the iavf traffic manager.
Patch 1 removes a second free of the queue TC map. The fault is in main
only, after commit f6e33f09f766. No release has it.
Patch 2 sets the queue ID and TC of each queue node in the queue
bandwidth message. Without it, a queue node with no shaper profile
resets queue 0, and its own queue keeps the rate limit that the PF
holds from an earlier process.
Patch 3 returns -ENOTSUP from the TM ops that read qos_cap when the PF
does not grant VIRTCHNL_VF_OFFLOAD_QOS, for example the in-tree ice PF.
These ops cause a segmentation fault now.
The Media Transport Library carries patches 2 and 3 on DPDK 26.07, and
tests them on E830 VFs with the out-of-tree ice PF. On a VF that an
earlier process rate limited, a TSC-paced 1080p59.94 stream runs at
27.5 fps. With patch 2, a commit of queue nodes without shaper profiles
removes the old limits, and the stream runs at 59.9 fps.
Dawid Wesierski (3):
net/iavf: fix invalid free of queue TC map
net/iavf: fix bandwidth config of unshaped queues
net/iavf: fix crash in TM ops without QoS capability
drivers/net/intel/iavf/iavf_tm.c | 42 ++++++++++++++++++++++++++++----
1 file changed, 37 insertions(+), 5 deletions(-)
base-commit: b39ee12b030f49c524b9d8c350a0f4b04141ccf9
--
2.43.0
---------------------------------------------------------------------
Intel Technology Poland sp. z o.o.
ul. Slowackiego 173 | 80-298 Gdansk | Sad Rejonowy Gdansk Polnoc | VII Wydzial Gospodarczy Krajowego Rejestru Sadowego - KRS 101882 | NIP 957-07-52-316 | Kapital zakladowy 200.000 PLN.
Spolka oswiadcza, ze posiada status duzego przedsiebiorcy w rozumieniu ustawy z dnia 8 marca 2013 r. o przeciwdzialaniu nadmiernym opoznieniom w transakcjach handlowych.
Ta wiadomosc wraz z zalacznikami jest przeznaczona dla okreslonego adresata i moze zawierac informacje poufne. W razie przypadkowego otrzymania tej wiadomosci, prosimy o powiadomienie nadawcy oraz trwale jej usuniecie; jakiekolwiek przegladanie lub rozpowszechnianie jest zabronione.
This e-mail and any attachments may contain confidential material for the sole use of the intended recipient(s). If you are not the intended recipient, please contact the sender and delete all copies; any review or distribution by others is strictly prohibited.
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH 1/3] net/iavf: fix invalid free of queue TC map
2026-10-14 12:24 [PATCH 0/3] net/iavf: fix TM hierarchy commit and TM ops without QoS Dawid Wesierski
@ 2026-10-14 12:24 ` Dawid Wesierski
2026-10-19 16:47 ` Bruce Richardson
2026-10-14 12:24 ` [PATCH 2/3] net/iavf: fix bandwidth config of unshaped queues Dawid Wesierski
2026-10-14 12:24 ` [PATCH 3/3] net/iavf: fix crash in TM ops without QoS capability Dawid Wesierski
2 siblings, 1 reply; 6+ messages in thread
From: Dawid Wesierski @ 2026-10-14 12:24 UTC (permalink / raw)
To: dev; +Cc: vladimir.medvedkin, bruce.richardson, anatoly.burakov,
marek.kasiewicz
iavf_hierarchy_commit() allocates the queue TC map with calloc(), and
it frees the previous map with free(old_qtc_map) after a successful
commit. A later change added rte_free(vf->qtc_map) in front of that
free(), because it was written for a tree that still leaked the map.
After the first commit, rte_free() gets a pointer from the libc
heap, and free() then releases the same pointer a second time.
rte_free() reads a malloc_elem header in the bytes in front of the
pointer. It usually logs "Invalid memory" and returns, but the result
depends on the contents of the libc heap.
Remove the rte_free() call. free(old_qtc_map) releases the old map.
Fixes: f6e33f09f766 ("net/iavf: disable runtime queue setup when rate limiting")
Signed-off-by: Dawid Wesierski <dawid.wesierski@intel.com>
---
drivers/net/intel/iavf/iavf_tm.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/net/intel/iavf/iavf_tm.c b/drivers/net/intel/iavf/iavf_tm.c
index fc84bf7e6b..603da09bb5 100644
--- a/drivers/net/intel/iavf/iavf_tm.c
+++ b/drivers/net/intel/iavf/iavf_tm.c
@@ -913,7 +913,6 @@ static int iavf_hierarchy_commit(struct rte_eth_dev *dev,
goto fail_clear;
/* replace the previously committed mapping, if any */
- rte_free(vf->qtc_map);
vf->qtc_map = qtc_map;
free(old_qtc_map);
if (adapter->stopped == 1)
--
2.43.0
---------------------------------------------------------------------
Intel Technology Poland sp. z o.o.
ul. Slowackiego 173 | 80-298 Gdansk | Sad Rejonowy Gdansk Polnoc | VII Wydzial Gospodarczy Krajowego Rejestru Sadowego - KRS 101882 | NIP 957-07-52-316 | Kapital zakladowy 200.000 PLN.
Spolka oswiadcza, ze posiada status duzego przedsiebiorcy w rozumieniu ustawy z dnia 8 marca 2013 r. o przeciwdzialaniu nadmiernym opoznieniom w transakcjach handlowych.
Ta wiadomosc wraz z zalacznikami jest przeznaczona dla okreslonego adresata i moze zawierac informacje poufne. W razie przypadkowego otrzymania tej wiadomosci, prosimy o powiadomienie nadawcy oraz trwale jej usuniecie; jakiekolwiek przegladanie lub rozpowszechnianie jest zabronione.
This e-mail and any attachments may contain confidential material for the sole use of the intended recipient(s). If you are not the intended recipient, please contact the sender and delete all copies; any review or distribution by others is strictly prohibited.
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH 2/3] net/iavf: fix bandwidth config of unshaped queues
2026-10-14 12:24 [PATCH 0/3] net/iavf: fix TM hierarchy commit and TM ops without QoS Dawid Wesierski
2026-10-14 12:24 ` [PATCH 1/3] net/iavf: fix invalid free of queue TC map Dawid Wesierski
@ 2026-10-14 12:24 ` Dawid Wesierski
2026-10-14 12:24 ` [PATCH 3/3] net/iavf: fix crash in TM ops without QoS capability Dawid Wesierski
2 siblings, 0 replies; 6+ messages in thread
From: Dawid Wesierski @ 2026-10-14 12:24 UTC (permalink / raw)
To: dev
Cc: vladimir.medvedkin, bruce.richardson, anatoly.burakov,
marek.kasiewicz, stable, Qi Zhang, Wenjun Wu, Ting Xu
iavf_hierarchy_commit() sends one virtchnl_queue_bw entry for each queue
node, but it sets queue_id and tc only for a node that has a shaper
profile. The entry of a node without a profile keeps queue_id 0 and
tc 0. The PF then applies the default bandwidth to queue 0 once for
each such entry, and the queue that the node describes keeps its old
rate limit.
The ice PF keeps the queue rate limits of a VF and applies them again
at each queue enable, also for a later process on the same VF. Thus an
application cannot remove the rate limits of an earlier process with a
commit of queue nodes without shaper profiles.
Set queue_id and tc for each queue node. A node without a shaper
profile now gives the default bandwidth to its own queue.
Fixes: 5779a8894d15 ("net/iavf: support queue rate limit configuration")
Cc: stable@dpdk.org
Signed-off-by: Dawid Wesierski <dawid.wesierski@intel.com>
---
drivers/net/intel/iavf/iavf_tm.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/intel/iavf/iavf_tm.c b/drivers/net/intel/iavf/iavf_tm.c
index 603da09bb5..57075ee5b8 100644
--- a/drivers/net/intel/iavf/iavf_tm.c
+++ b/drivers/net/intel/iavf/iavf_tm.c
@@ -867,15 +867,15 @@ static int iavf_hierarchy_commit(struct rte_eth_dev *dev,
}
q_tc_mapping->tc[tm_node->tc].req.queue_count++;
+ q_bw->cfg[node_committed].queue_id = tm_node->id;
+ q_bw->cfg[node_committed].tc = tm_node->tc;
if (tm_node->shaper_profile) {
- q_bw->cfg[node_committed].queue_id = tm_node->id;
q_bw->cfg[node_committed].shaper.peak =
tm_node->shaper_profile->profile.peak.rate /
1000 * IAVF_BITS_PER_BYTE;
q_bw->cfg[node_committed].shaper.committed =
tm_node->shaper_profile->profile.committed.rate /
1000 * IAVF_BITS_PER_BYTE;
- q_bw->cfg[node_committed].tc = tm_node->tc;
}
node_committed++;
--
2.43.0
---------------------------------------------------------------------
Intel Technology Poland sp. z o.o.
ul. Slowackiego 173 | 80-298 Gdansk | Sad Rejonowy Gdansk Polnoc | VII Wydzial Gospodarczy Krajowego Rejestru Sadowego - KRS 101882 | NIP 957-07-52-316 | Kapital zakladowy 200.000 PLN.
Spolka oswiadcza, ze posiada status duzego przedsiebiorcy w rozumieniu ustawy z dnia 8 marca 2013 r. o przeciwdzialaniu nadmiernym opoznieniom w transakcjach handlowych.
Ta wiadomosc wraz z zalacznikami jest przeznaczona dla okreslonego adresata i moze zawierac informacje poufne. W razie przypadkowego otrzymania tej wiadomosci, prosimy o powiadomienie nadawcy oraz trwale jej usuniecie; jakiekolwiek przegladanie lub rozpowszechnianie jest zabronione.
This e-mail and any attachments may contain confidential material for the sole use of the intended recipient(s). If you are not the intended recipient, please contact the sender and delete all copies; any review or distribution by others is strictly prohibited.
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH 3/3] net/iavf: fix crash in TM ops without QoS capability
2026-10-14 12:24 [PATCH 0/3] net/iavf: fix TM hierarchy commit and TM ops without QoS Dawid Wesierski
2026-10-14 12:24 ` [PATCH 1/3] net/iavf: fix invalid free of queue TC map Dawid Wesierski
2026-10-14 12:24 ` [PATCH 2/3] net/iavf: fix bandwidth config of unshaped queues Dawid Wesierski
@ 2026-10-14 12:24 ` Dawid Wesierski
2 siblings, 0 replies; 6+ messages in thread
From: Dawid Wesierski @ 2026-10-14 12:24 UTC (permalink / raw)
To: dev
Cc: vladimir.medvedkin, bruce.richardson, anatoly.burakov,
marek.kasiewicz, stable, Ting Xu, Qiming Yang, Qi Zhang
The VF allocates qos_cap and initializes the TM lists only when the PF
grants VIRTCHNL_VF_OFFLOAD_QOS. The in-tree ice PF does not grant it.
On such a VF, node add, shaper profile add, capabilities get, and node
capabilities get dereference a NULL qos_cap, or insert into a list that
has no initialization. The application gets a segmentation fault from a
call such as rte_tm_capabilities_get().
Return -ENOTSUP from these operations when qos_cap is NULL. The other
TM operations only search the lists, or check VIRTCHNL_VF_OFFLOAD_QOS
already, so they do not need the check.
Fixes: 44d0a720a538 ("net/iavf: query QoS capabilities and set queue TC mapping")
Cc: stable@dpdk.org
Signed-off-by: Dawid Wesierski <dawid.wesierski@intel.com>
---
drivers/net/intel/iavf/iavf_tm.c | 37 ++++++++++++++++++++++++++++++--
1 file changed, 35 insertions(+), 2 deletions(-)
diff --git a/drivers/net/intel/iavf/iavf_tm.c b/drivers/net/intel/iavf/iavf_tm.c
index 57075ee5b8..07ba58f6f5 100644
--- a/drivers/net/intel/iavf/iavf_tm.c
+++ b/drivers/net/intel/iavf/iavf_tm.c
@@ -102,6 +102,18 @@ iavf_tm_conf_uninit(struct rte_eth_dev *dev)
vf->qtc_map = NULL;
}
+/* qos_cap and the TM lists exist only if the PF grants VIRTCHNL_VF_OFFLOAD_QOS. */
+static int
+iavf_tm_qos_check(struct iavf_info *vf, struct rte_tm_error *error)
+{
+ if (vf->qos_cap != NULL)
+ return 0;
+
+ error->type = RTE_TM_ERROR_TYPE_CAPABILITIES;
+ error->message = "VF has no QoS capability";
+ return -ENOTSUP;
+}
+
static inline struct iavf_tm_node *
iavf_tm_node_search(struct rte_eth_dev *dev,
uint32_t node_id, enum iavf_tm_node_type *node_type)
@@ -279,12 +291,18 @@ iavf_tm_node_add(struct rte_eth_dev *dev, uint32_t node_id,
struct iavf_tm_shaper_profile *shaper_profile = NULL;
struct iavf_tm_node *tm_node;
struct iavf_tm_node *parent_node;
- uint16_t tc_nb = vf->qos_cap->num_elem;
+ uint16_t tc_nb;
int ret;
if (!params || !error)
return -EINVAL;
+ ret = iavf_tm_qos_check(vf, error);
+ if (ret)
+ return ret;
+
+ tc_nb = vf->qos_cap->num_elem;
+
/* if already committed */
if (vf->tm_conf.committed) {
error->type = RTE_TM_ERROR_TYPE_UNSPECIFIED;
@@ -524,6 +542,10 @@ iavf_shaper_profile_add(struct rte_eth_dev *dev,
if (!profile || !error)
return -EINVAL;
+ ret = iavf_tm_qos_check(vf, error);
+ if (ret)
+ return ret;
+
ret = iavf_shaper_profile_param_check(profile, error);
if (ret)
return ret;
@@ -588,11 +610,17 @@ iavf_tm_capabilities_get(struct rte_eth_dev *dev,
struct rte_tm_error *error)
{
struct iavf_info *vf = IAVF_DEV_PRIVATE_TO_VF(dev->data->dev_private);
- uint16_t tc_nb = vf->qos_cap->num_elem;
+ uint16_t tc_nb;
+ int ret;
if (!cap || !error)
return -EINVAL;
+ ret = iavf_tm_qos_check(vf, error);
+ if (ret)
+ return ret;
+
+ tc_nb = vf->qos_cap->num_elem;
if (tc_nb > vf->vf_res->num_queue_pairs)
return -EINVAL;
@@ -744,10 +772,15 @@ iavf_node_capabilities_get(struct rte_eth_dev *dev,
enum iavf_tm_node_type node_type;
struct virtchnl_qos_cap_elem tc_cap;
struct iavf_tm_node *tm_node;
+ int ret;
if (!cap || !error)
return -EINVAL;
+ ret = iavf_tm_qos_check(vf, error);
+ if (ret)
+ return ret;
+
if (node_id == RTE_TM_NODE_ID_NULL) {
error->type = RTE_TM_ERROR_TYPE_NODE_ID;
error->message = "invalid node id";
--
2.43.0
---------------------------------------------------------------------
Intel Technology Poland sp. z o.o.
ul. Slowackiego 173 | 80-298 Gdansk | Sad Rejonowy Gdansk Polnoc | VII Wydzial Gospodarczy Krajowego Rejestru Sadowego - KRS 101882 | NIP 957-07-52-316 | Kapital zakladowy 200.000 PLN.
Spolka oswiadcza, ze posiada status duzego przedsiebiorcy w rozumieniu ustawy z dnia 8 marca 2013 r. o przeciwdzialaniu nadmiernym opoznieniom w transakcjach handlowych.
Ta wiadomosc wraz z zalacznikami jest przeznaczona dla okreslonego adresata i moze zawierac informacje poufne. W razie przypadkowego otrzymania tej wiadomosci, prosimy o powiadomienie nadawcy oraz trwale jej usuniecie; jakiekolwiek przegladanie lub rozpowszechnianie jest zabronione.
This e-mail and any attachments may contain confidential material for the sole use of the intended recipient(s). If you are not the intended recipient, please contact the sender and delete all copies; any review or distribution by others is strictly prohibited.
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH 1/3] net/iavf: fix invalid free of queue TC map
2026-10-14 12:24 ` [PATCH 1/3] net/iavf: fix invalid free of queue TC map Dawid Wesierski
@ 2026-10-19 16:47 ` Bruce Richardson
2026-10-19 17:06 ` Bruce Richardson
0 siblings, 1 reply; 6+ messages in thread
From: Bruce Richardson @ 2026-10-19 16:47 UTC (permalink / raw)
To: Dawid Wesierski; +Cc: dev, vladimir.medvedkin, anatoly.burakov, marek.kasiewicz
On Wed, Oct 14, 2026 at 12:24:16PM +0000, Dawid Wesierski wrote:
> iavf_hierarchy_commit() allocates the queue TC map with calloc(), and
> it frees the previous map with free(old_qtc_map) after a successful
> commit. A later change added rte_free(vf->qtc_map) in front of that
> free(), because it was written for a tree that still leaked the map.
>
> After the first commit, rte_free() gets a pointer from the libc
> heap, and free() then releases the same pointer a second time.
> rte_free() reads a malloc_elem header in the bytes in front of the
> pointer. It usually logs "Invalid memory" and returns, but the result
> depends on the contents of the libc heap.
>
> Remove the rte_free() call. free(old_qtc_map) releases the old map.
>
> Fixes: f6e33f09f766 ("net/iavf: disable runtime queue setup when rate limiting")
>
> Signed-off-by: Dawid Wesierski <dawid.wesierski@intel.com>
> ---
Acked-by: Bruce Richardson <bruce.richardson@intel.com>
> drivers/net/intel/iavf/iavf_tm.c | 1 -
> 1 file changed, 1 deletion(-)
>
> diff --git a/drivers/net/intel/iavf/iavf_tm.c b/drivers/net/intel/iavf/iavf_tm.c
> index fc84bf7e6b..603da09bb5 100644
> --- a/drivers/net/intel/iavf/iavf_tm.c
> +++ b/drivers/net/intel/iavf/iavf_tm.c
> @@ -913,7 +913,6 @@ static int iavf_hierarchy_commit(struct rte_eth_dev *dev,
> goto fail_clear;
>
> /* replace the previously committed mapping, if any */
> - rte_free(vf->qtc_map);
> vf->qtc_map = qtc_map;
> free(old_qtc_map);
> if (adapter->stopped == 1)
> --
> 2.43.0
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 1/3] net/iavf: fix invalid free of queue TC map
2026-10-19 16:47 ` Bruce Richardson
@ 2026-10-19 17:06 ` Bruce Richardson
0 siblings, 0 replies; 6+ messages in thread
From: Bruce Richardson @ 2026-10-19 17:06 UTC (permalink / raw)
To: Dawid Wesierski; +Cc: dev, vladimir.medvedkin, anatoly.burakov, marek.kasiewicz
On Mon, Oct 19, 2026 at 05:47:16PM +0100, Bruce Richardson wrote:
> On Wed, Oct 14, 2026 at 12:24:16PM +0000, Dawid Wesierski wrote:
> > iavf_hierarchy_commit() allocates the queue TC map with calloc(), and
> > it frees the previous map with free(old_qtc_map) after a successful
> > commit. A later change added rte_free(vf->qtc_map) in front of that
> > free(), because it was written for a tree that still leaked the map.
> >
> > After the first commit, rte_free() gets a pointer from the libc
> > heap, and free() then releases the same pointer a second time.
> > rte_free() reads a malloc_elem header in the bytes in front of the
> > pointer. It usually logs "Invalid memory" and returns, but the result
> > depends on the contents of the libc heap.
> >
> > Remove the rte_free() call. free(old_qtc_map) releases the old map.
> >
> > Fixes: f6e33f09f766 ("net/iavf: disable runtime queue setup when rate limiting")
AI review flags the fact that this commit also introduces an erroneous
rte_free call in iavf_uninit_vf() in iavf_ethdev.c. While the call is
harmless (and earler free is done and the pointer is set to NULL making
rte_free a no-op) it would be good to remove that too.
> >
> > Signed-off-by: Dawid Wesierski <dawid.wesierski@intel.com>
> > ---
> Acked-by: Bruce Richardson <bruce.richardson@intel.com>
> > drivers/net/intel/iavf/iavf_tm.c | 1 -
> > 1 file changed, 1 deletion(-)
> >
> > diff --git a/drivers/net/intel/iavf/iavf_tm.c b/drivers/net/intel/iavf/iavf_tm.c
> > index fc84bf7e6b..603da09bb5 100644
> > --- a/drivers/net/intel/iavf/iavf_tm.c
> > +++ b/drivers/net/intel/iavf/iavf_tm.c
> > @@ -913,7 +913,6 @@ static int iavf_hierarchy_commit(struct rte_eth_dev *dev,
> > goto fail_clear;
> >
> > /* replace the previously committed mapping, if any */
> > - rte_free(vf->qtc_map);
> > vf->qtc_map = qtc_map;
> > free(old_qtc_map);
> > if (adapter->stopped == 1)
> > --
> > 2.43.0
> >
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-10-19 17:07 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-10-14 12:24 [PATCH 0/3] net/iavf: fix TM hierarchy commit and TM ops without QoS Dawid Wesierski
2026-10-14 12:24 ` [PATCH 1/3] net/iavf: fix invalid free of queue TC map Dawid Wesierski
2026-10-19 16:47 ` Bruce Richardson
2026-10-19 17:06 ` Bruce Richardson
2026-10-14 12:24 ` [PATCH 2/3] net/iavf: fix bandwidth config of unshaped queues Dawid Wesierski
2026-10-14 12:24 ` [PATCH 3/3] net/iavf: fix crash in TM ops without QoS capability Dawid Wesierski
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox