zxdh_bar_irq_recv() allocates a buffer for the payload of every
message it takes off the BAR channel and frees it on two of its three
exits. The third exit, taken when the header is marked asynchronous
and not an ack, returns with the buffer still allocated. Those two
header bits are written by the VF itself, so a guest can pin about
2176 bytes of the process-wide rte_malloc heap per message, with no
per-VF accounting, until the heap is full: the PF then stops
answering mailbox requests from every VF and its own table updates
fail until the process is restarted.
Route that path through the existing exit label so the buffer is
freed like on the other two paths. The return value is unchanged
(ZXDH_BAR_MSG_OK is 0) and synchronous and acked messages are
untouched.
Fixes: 3630ac8bd81f ("net/zxdh: configure interrupt")
Cc: [email protected]
Signed-off-by: Junlong Wang <[email protected]>
---
drivers/net/zxdh/zxdh_msg.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/drivers/net/zxdh/zxdh_msg.c b/drivers/net/zxdh/zxdh_msg.c
index 6aafefe289..c7a3281987 100644
--- a/drivers/net/zxdh/zxdh_msg.c
+++ b/drivers/net/zxdh/zxdh_msg.c
@@ -1023,11 +1023,8 @@ zxdh_bar_irq_recv(uint8_t src, uint8_t dst, uint64_t
virt_addr, void *dev)
goto exit;
}
zxdh_bar_chan_msg_valid_set(recv_addr, ZXDH_BAR_MSG_CHAN_USABLE);
- if (msg_header.ack == ZXDH_BAR_CHAN_MSG_ACK) {
+ if (msg_header.ack == ZXDH_BAR_CHAN_MSG_ACK)
zxdh_bar_msg_ack_async_msg_proc(&msg_header, recved_msg);
- goto exit;
- }
- return 0;
exit:
rte_free(recved_msg);
--
2.27.0
