The sw_td path in dpaa2_dev_tx() reads from the wrong position in the
bufs array. When the goto fires, bufs has already been advanced past
the num_tx successfully sent packets. The first loop then reads num_tx
more entries starting from bufs, going past the end of the input array.
Additionally, the buf_to_free segments for already-enqueued packets
are never freed, leaking memory.
Replace the buggy sw_td code with the same pattern used in
dpaa2_dev_tx_ordered(): free buf_to_free segments first, then use
rte_pktmbuf_free_bulk() to drop remaining unsent packets.
Not tested, found by code review.
Fixes: c3ffe74d85be ("net/dpaa2: support software taildrop")
Cc: [email protected]
Reported-by: Stephen Hemminger <[email protected]>
Signed-off-by: Maxime Leroy <[email protected]>
---
drivers/net/dpaa2/dpaa2_rxtx.c | 18 ++++++------------
1 file changed, 6 insertions(+), 12 deletions(-)
diff --git a/drivers/net/dpaa2/dpaa2_rxtx.c b/drivers/net/dpaa2/dpaa2_rxtx.c
index 689e5e7ee7..8275ba9780 100644
--- a/drivers/net/dpaa2/dpaa2_rxtx.c
+++ b/drivers/net/dpaa2/dpaa2_rxtx.c
@@ -1517,21 +1517,15 @@ dpaa2_dev_tx(void *queue, struct rte_mbuf **bufs,
uint16_t nb_pkts)
return num_tx;
sw_td:
- loop = 0;
- while (loop < num_tx) {
- if (unlikely(RTE_MBUF_HAS_EXTBUF(*bufs)))
- rte_pktmbuf_free(*bufs);
- bufs++;
- loop++;
+ for (loop = 0; loop < free_count; loop++) {
+ if (buf_to_free[loop].pkt_id < num_tx)
+ rte_pktmbuf_free_seg(buf_to_free[loop].seg);
}
/* free the pending buffers */
- while (nb_pkts) {
- rte_pktmbuf_free(*bufs);
- bufs++;
- nb_pkts--;
- num_tx++;
- }
+ rte_pktmbuf_free_bulk(bufs, nb_pkts);
+
+ num_tx += nb_pkts;
dpaa2_q->tx_pkts += num_tx;
return num_tx;
--
2.43.0
