Commit 731ddc71 authored by Alexey Marchuk's avatar Alexey Marchuk Committed by Tomasz Zawadzki
Browse files

bdev/compress: Correctly free mbufs in error case 



rte_pktmbuf_free frees the given mbuf and any chained mbufs.
It can cause double free of some mbuf if we free every mbuf
in a loop. Instead use rte_pktmbuf_free_bulk which correctly release
chained mbufs.

Signed-off-by: default avatarAlexey Marchuk <alexeymar@mellanox.com>
Change-Id: I55fd7832ff656f519a4ed2f02de8ef1a0f637a02
Reviewed-on: https://review.spdk.io/gerrit/c/spdk/spdk/+/11972


Community-CI: Broadcom CI <spdk-ci.pdl@broadcom.com>
Community-CI: Mellanox Build Bot
Reviewed-by: default avatarShuhei Matsumoto <smatsumoto@nvidia.com>
Reviewed-by: default avatarPaul Luse <paul.e.luse@intel.com>
Reviewed-by: default avatarJim Harris <james.r.harris@intel.com>
Tested-by: default avatarSPDK CI Jenkins <sys_sgci@intel.com>
parent bfd7fcb8

module/bdev/compress/vbdev_compress.c

+2 −13
Original line number Diff line number Diff line
@@ -540,7 +540,6 @@ _compress_operation(struct spdk_reduce_backing_dev *backing_dev, struct iovec *s 
	uint64_t total_length = 0;

	int rc = 0;

	struct vbdev_comp_op *op_to_queue;

	int i;

	int src_mbuf_total = src_iovcnt;

	int dst_mbuf_total = dst_iovcnt;

	bool device_error = false;
@@ -615,27 +614,17 @@ _compress_operation(struct spdk_reduce_backing_dev *backing_dev, struct iovec *s 
	if (rc == 1) {

		return 0;

	} else if (comp_op->status == RTE_COMP_OP_STATUS_NOT_PROCESSED) {

		/* we free mbufs differently depending on whether they were chained or not */

		rte_pktmbuf_free(comp_op->m_src);

		rte_pktmbuf_free(comp_op->m_dst);

		rc = -EAGAIN;

		goto error_enqueue;

	} else {

		device_error = true;

		goto error_src_dst;

	}



	/* Error cleanup paths. */

error_src_dst:

	for (i = 0; i < dst_mbuf_total; i++) {

		rte_pktmbuf_free((struct rte_mbuf *)&dst_mbufs[i]);

	}

	rte_pktmbuf_free_bulk(dst_mbufs, dst_iovcnt);

error_get_dst:

	for (i = 0; i < src_mbuf_total; i++) {

		rte_pktmbuf_free((struct rte_mbuf *)&src_mbufs[i]);

	}

	rte_pktmbuf_free_bulk(src_mbufs, src_iovcnt);

error_get_src:

error_enqueue:

	rte_comp_op_free(comp_op);

error_get_op:

test/unit/lib/bdev/compress.c/compress_ut.c

+7 −0
Original line number Diff line number Diff line
@@ -3,6 +3,7 @@ 
 *

 *   Copyright (c) Intel Corporation.

 *   All rights reserved.

 *   Copyright (c) 2022 NVIDIA CORPORATION & AFFILIATES. All rights reserved.

 *

 *   Redistribution and use in source and binary forms, with or without

 *   modification, are permitted provided that the following conditions
@@ -184,6 +185,12 @@ void mock_rte_pktmbuf_free(struct rte_mbuf *m) 
{

}



void mock_rte_pktmbuf_free_bulk(struct rte_mbuf **m, unsigned int cnt);

#define rte_pktmbuf_free_bulk mock_rte_pktmbuf_free_bulk

void mock_rte_pktmbuf_free_bulk(struct rte_mbuf **m, unsigned int cnt)

{

}



static bool ut_boundary_alloc = false;

static int ut_rte_pktmbuf_alloc_bulk = 0;

int mock_rte_pktmbuf_alloc_bulk(struct rte_mempool *pool, struct rte_mbuf **mbufs,