History

ixgbe: deleting dfwd stations out of order can cause null ptr deref

The number of stations in use is kept in the num_rx_pools counter in the ixgbe_adapter structure. This is in turn used by the queue allocation scheme to determine how many queues are needed to support the number of pools in use with the current feature set. This works as long as the pools are added and destroyed in order because (num_rx_pools * queues_per_pool) is equal to the last queue in use by a pool. But as soon as you delete a pool out of order this is no longer the case. So the above multiplication allocates to few queues and a pool may reference a ring that has not been allocated/initialized. To resolve use the bit mask of in use pools to determine the final pool being used and allocate enough queues so that we don't inadvertently remove its queues. # ip link add link eth2 \ numtxqueues 4 numrxqueues 4 txqueuelen 50 type macvlan # ip link set dev macvlan0 up # ip link add link eth2 \ numtxqueues 4 numrxqueues 4 txqueuelen 50 type macvlan # ip link set dev macvlan1 up # for i in {0..100}; do ip link set dev macvlan0 down; ip link set dev macvlan0 up; done;

John Fastabend committed 13 years ago

Commit 51f37731 parent 219354d1 file · +6 −2Browse files

Unified · Split

drivers/net/ethernet/intel/ixgbe/ixgbe_main.c+6−2
@@ -7536,6 +7536,7 @@ static void *ixgbe_fwd_add(struct net_device *pdev, struct net_device *vdev) · 7535 unmodified lines
75367536 {
75377537 struct ixgbe_fwd_adapter *fwd_adapter = NULL;
75387538 struct ixgbe_adapter *adapter = netdev_priv(pdev);
7539+ unsigned int limit;
75397540 int pool, err;
75407541
75417542 #ifdef CONFIG_RPS
@@ -7566,10 +7567,11 @@ static void *ixgbe_fwd_add(struct net_device *pdev, struct net_device *vdev) · 24 unmodified lines
75667567 pool = find_first_zero_bit(&adapter->fwd_bitmask, 32);
75677568 adapter->num_rx_pools++;
75687569 set_bit(pool, &adapter->fwd_bitmask);
7570+ limit = find_last_bit(&adapter->fwd_bitmask, 32);
75697571
75707572 /* Enable VMDq flag so device will be set in VM mode */
75717573 adapter->flags |= IXGBE_FLAG_VMDQ_ENABLED | IXGBE_FLAG_SRIOV_ENABLED;
7572− adapter->ring_feature[RING_F_VMDQ].limit = adapter->num_rx_pools;
7574+ adapter->ring_feature[RING_F_VMDQ].limit = limit + 1;
75737575 adapter->ring_feature[RING_F_RSS].limit = vdev->num_tx_queues;
75747576
75757577 /* Force reinit of ring allocation with VMDQ enabled */
@@ -7597,11 +7599,13 @@ static void ixgbe_fwd_del(struct net_device *pdev, void *priv) · 21 unmodified lines
75977599 {
75987600 struct ixgbe_fwd_adapter *fwd_adapter = priv;
75997601 struct ixgbe_adapter *adapter = fwd_adapter->real_adapter;
7602+ unsigned int limit;
76007603
76017604 clear_bit(fwd_adapter->pool, &adapter->fwd_bitmask);
76027605 adapter->num_rx_pools--;
76037606
7604− adapter->ring_feature[RING_F_VMDQ].limit = adapter->num_rx_pools;
7607+ limit = find_last_bit(&adapter->fwd_bitmask, 32);
7608+ adapter->ring_feature[RING_F_VMDQ].limit = limit + 1;
76057609 ixgbe_fwd_ring_down(fwd_adapter->netdev, fwd_adapter);
76067610 ixgbe_setup_tc(pdev, netdev_get_num_tc(pdev));
76077611 netdev_dbg(pdev, "pool %i:%i queues %i:%i VSI bitmask %lx\n",