Skip to content

net/netvsc: bug fixes and runtime queue reconfiguration

Long Li dpdk-dev 3 versions – In review

Get series with b4
b4 am [email protected]

Versions newest first · linked by author and title

  1. v4 Latest6 patches 2 repliesIn review
  2. v36 patches 1 replySuperseded
  3. v22 patches 2 repliesSuperseded

Changes in v4 from the cover letter

- Patch 5 (MTU change): NULL out closed subchannel pointers (hv->channels[i] = NULL) and reset hv->num_queues = 1 after closing secondary channels to prevent stale pointer use-after-free
- Patch 5 (MTU change): reassign hv->primary->chan after reopening channel so it points to the new channel, not the freed one

Patches in v4 No applies recorded yet

#Subject and filesSizeRepliesApplied
1/6net/netvsc: fix subchannel leak on device removaldrivers/net/netvsc/hn_ethdev.c+10 -00 replies
2/6net/netvsc: fix double-free of primary Rx queue on uninitdrivers/net/netvsc/hn_ethdev.c+0 -10 replies
3/6net/netvsc: fix resource leak in init error pathdrivers/net/netvsc/hn_ethdev.c+9 -30 replies
4/6net/netvsc: fix event callback leak on rxfilter failuredrivers/net/netvsc/hn_ethdev.c+10 -40 replies
5/6net/netvsc: fix resource leaks in MTU change pathdrivers/net/netvsc/hn_ethdev.c+16 -20 replies
6/6net/netvsc: support runtime queue count reconfigurationdrivers/net/netvsc/hn_ethdev.c drivers/net/netvsc/hn_vf.c+194 -160 replies

Reviews trailers per patch

No Reviewed-by, Acked-by or Tested-by trailers for v4 yet.

Read the v4 thread

Cover letter [PATCH v4 0/6] net/netvsc: bug fixes and runtime queue reconfiguration

This series fixes several resource management bugs in the netvsc PMD and adds support for runtime queue count reconfiguration.

Patches 1-5 are bug fixes:
1. Subchannel leak on device removal — subchannels allocated during configure are never closed in uninit.
2. Double-free of primary Rx queue — hn_dev_free_queues() already

     frees hv->primary, then uninit frees it again.

3. Init error path leaks — hv->primary and hv->channels[0] not freed on failure after allocation.
4. Event callback leak — device event callback not unregistered when rxfilter or vf_start fails in hn_dev_start().
5. MTU change path leaks — missing chimney bitmap teardown/rebuild, rxbuf_info leak, stale subchannel pointers, and VMBus channel close before free.

Patch 6 adds runtime queue count reconfiguration via port stop/configure/start, with full NVS/RNDIS session teardown and reinit when the queue count changes.

Tested:
- Queue reconfig: 4→2→8 queues, all transitions successful
- MTU changes: 1500→4000→8000 with rxd/txd=2048, no crashes
- TX pps: 15.5M (1500B), 6.1M (4000B), 3.1M (8000B)
- RX pps: 7.6M (1500B), 2.7M (4000B), 1.4M (8000B)

v4:
- Patch 5 (MTU change): NULL out closed subchannel pointers (hv->channels[i] = NULL) and reset hv->num_queues = 1 after closing secondary channels to prevent stale pointer use-after-free
- Patch 5 (MTU change): reassign hv->primary->chan after reopening channel so it points to the new channel, not the freed one

v3:
- Split into 6 patches: 5 bug fixes (patches 1-5) + 1 feature (patch 6)
- New patch 2: fix double-free of primary Rx queue on uninit
- New patch 3: fix resource leak in init error path
- New patch 4: fix event callback leak on rxfilter/vf_start failure
- New patch 5: fix resource leaks in MTU change path (chimney bitmap, rxbuf_info leak, missing VMBus chan close before free)
- Patch 6 (reconfig): fix subchan_cleanup to call hn_rndis_conf_offload so device retains offload config on partial failure
- Patch 6 (reconfig): fix recovery path to set hv->primary->chan after re-opening channel, preventing use-after-free of stale pointer
- Patch 6 (reconfig): add hn_chim_init in recovery path to rebuild chimney bitmap after successful recovery
- Fix Fixes tag on patch 5 to point to correct MTU support commit

v2:
- Split subchannel leak fix into separate patch with Fixes tag (patch 1)
- Fix reinit_failed recovery: re-map device before chan_open when device is unmapped to prevent undefined behavior on unmapped ring buffers
- Move hn_rndis_conf_offload() to after reinit block so offload config targets the final RNDIS session instead of being lost on teardown
- Use write lock in hn_vf_tx/rx_queue_release() to prevent race with concurrent fast-path readers holding read lock
- Reset RSS indirection table to queue 0 in subchan_cleanup error path
- Fix multi-line comment style to follow DPDK convention

Long Li (6):
net/netvsc: fix subchannel leak on device removal net/netvsc: fix double-free of primary Rx queue on uninit net/netvsc: fix resource leak in init error path net/netvsc: fix event callback leak on rxfilter failure net/netvsc: fix resource leaks in MTU change path net/netvsc: support runtime queue count reconfiguration

 drivers/net/netvsc/hn_ethdev.c | 249 ++++++++++++++++++++++++++++++---
 drivers/net/netvsc/hn_vf.c     |  16 ++-
 2 files changed, 239 insertions(+), 26 deletions(-)
Signature · 1 line
2.43.0