When a packet exceeds max_send_sge or when populating SGL segments fails,
mana_tx_burst() skipped the failed packet using continue.
Under the DPDK rte_eth_tx_burst() API contract, callers assume that the
returned count represents a contiguous prefix of transmitted packets
(tx_pkts[0 .. nb_tx - 1]). Skipping a packet in the middle of a burst
causes subsequent packets to be transmitted while the caller treats them
as unsent and frees them. When hardware later generates CQEs for those
transmitted packets, they are freed a second time, corrupting mbuf pools
and free caches.
Fix this by terminating the burst loop with break upon packet errors so
that pkt_sent accurately reflects the contiguous prefix sent.
Fixes: 7f322844f427 ("net/mana: send packets")
Cc: [email protected]
Signed-off-by: Tathagat Priyadarshi <[email protected]>
---
drivers/net/mana/tx.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/mana/tx.c b/drivers/net/mana/tx.c
index 10f2212b5d..d35030cbe5 100644
--- a/drivers/net/mana/tx.c
+++ b/drivers/net/mana/tx.c
@@ -281,7 +281,7 @@ mana_tx_burst(void *dpdk_txq, struct rte_mbuf **tx_pkts,
uint16_t nb_pkts)
if (m_pkt->nb_segs > priv->max_send_sge) {
DP_LOG(ERR, "send packet segments %d exceeding max",
m_pkt->nb_segs);
- continue;
+ break;
}
/* Fill in the oob */
@@ -432,7 +432,7 @@ mana_tx_burst(void *dpdk_txq, struct rte_mbuf **tx_pkts,
uint16_t nb_pkts)
/* Skip this packet if we can't populate all segments */
if (seg_idx != m_pkt->nb_segs)
- continue;
+ break;
/* If we can at least queue post two WQEs and there are at
* least two packets to send, use TX CQE suppression for the
--
2.43.0
