Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

vdpa/virtio: Fix virtio_vdpa_virtq_doorbell_relay_disable crash #38

Merged
merged 1 commit into from
Sep 18, 2023

Conversation

yajwu
Copy link
Collaborator

@yajwu yajwu commented Sep 11, 2023

When MSIX configured less then queue number, quit testpmd in VM, cause vDPA crash.

#3  0x00007fbc8421b489 in _int_free () from /lib64/libc.so.6
#4  0x0000000001a471c5 in virtio_vdpa_virtq_doorbell_relay_disable (vq_idx=vq_idx@entry=11, priv=<optimized out>, priv=<optimized out>) at ../drivers/vdpa/virtio/virtio_vdpa.c:349
#5  0x0000000001a47275 in virtio_vdpa_virtq_disable () at ../drivers/vdpa/virtio/virtio_vdpa.c:413
#6  0x0000000001a47a5a in virtio_vdpa_vring_state_set () at ../drivers/vdpa/virtio/virtio_vdpa.c:588
#7  0x00000000005ad8af in vhost_user_notify_queue_state (dev=0x17ffcd000, index=11, enable=0) at ../lib/vhost/vhost_user.c:283
#8  0x00000000005b0414 in vhost_user_msg_handler (vid=<optimized out>, fd=<optimized out>) at ../lib/vhost/vhost_user.c:3164
#9  0x00000000012f812f in vhost_user_read_cb () at ../lib/vhost/socket.c:310

When callfd == -1, virtio_pci_dev_interrupt_enable is skipped. But in virtio_vdpa_virtq_disable, no such check to skip virtio_pci_dev_interrupt_disable. virtio_vdpa_virtq_disable return error without changing queue state to disable. Double free is caused by this wrong queue state.

The fix is to add/check vector_enable variable for virtio_pci_dev_interrupt_disable. And remove error return in virtio_vdpa_virtq_disable.

RM: 3587409

When MSIX configured less then queue number, quit testpmd in VM,
cause vDPA crash.

	Mellanox#3  0x00007fbc8421b489 in _int_free () from /lib64/libc.so.6
	Mellanox#4  0x0000000001a471c5 in virtio_vdpa_virtq_doorbell_relay_disable (vq_idx=vq_idx@entry=11, priv=<optimized out>, priv=<optimized out>) at ../drivers/vdpa/virtio/virtio_vdpa.c:349
	Mellanox#5  0x0000000001a47275 in virtio_vdpa_virtq_disable () at ../drivers/vdpa/virtio/virtio_vdpa.c:413
	Mellanox#6  0x0000000001a47a5a in virtio_vdpa_vring_state_set () at ../drivers/vdpa/virtio/virtio_vdpa.c:588
	Mellanox#7  0x00000000005ad8af in vhost_user_notify_queue_state (dev=0x17ffcd000, index=11, enable=0) at ../lib/vhost/vhost_user.c:283
	Mellanox#8  0x00000000005b0414 in vhost_user_msg_handler (vid=<optimized out>, fd=<optimized out>) at ../lib/vhost/vhost_user.c:3164
	Mellanox#9  0x00000000012f812f in vhost_user_read_cb () at ../lib/vhost/socket.c:310

When callfd == -1, virtio_pci_dev_interrupt_enable is skipped. But in
virtio_vdpa_virtq_disable, no such check to skip virtio_pci_dev_interrupt_disable.
virtio_vdpa_virtq_disable return error without changing queue state to disable.
Double free is caused by this wrong queue state.

The fix is to add/check vector_enable variable for virtio_pci_dev_interrupt_disable.
And remove error return in virtio_vdpa_virtq_disable.

RM: 3587409
Signed-off-by: Yajun Wu <yajunw@nvidia.com>
@kailiangz1 kailiangz1 merged commit 3127304 into Mellanox:main Sep 18, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
2 participants