Message ID | 20231211123144.3759488-1-aleksander.lobakin@intel.com |
---|---|
State | New |
Headers |
Return-Path: <linux-kernel-owner@vger.kernel.org> Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:bcd1:0:b0:403:3b70:6f57 with SMTP id r17csp7010400vqy; Mon, 11 Dec 2023 04:33:46 -0800 (PST) X-Google-Smtp-Source: AGHT+IGWxbxMq62zfmvlZ97Y0FgGLzY0BAqtEpI9r9qT+tfQONUxfIhSWaJOxPBFRb7TLm+dQqJV X-Received: by 2002:a17:90a:5d93:b0:286:a962:d4de with SMTP id t19-20020a17090a5d9300b00286a962d4demr1708571pji.49.1702298026027; Mon, 11 Dec 2023 04:33:46 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1702298026; cv=none; d=google.com; s=arc-20160816; b=OBQA07yuJRTXwEAKvIuUARYUODVypD8tThJ+TkbWH1baDgNgh+15X+8UNp5XZBL50E dEBtvO1jf+wflAO3c1uAvwUYyVhgBUJDvuwkbQfrvLYT5ZbLwdSHEKuaIkzoliejrbEQ 1sNhrkeOeB4iVY7RRDUubBLDLizzkxDjHS7Db/FhYnNc+D7om4m6zOSd26teDp1812LP IVLcUXOMydSKSEwYODca/qMlzfOvBZdfNLdNV/ycegZHp5ANp8Sw19vMryc7hvIdEXiI yBU0icK7/PaT0tOAQWPwR1U23ypPxR/eqniV77+okXGyiRFHTQBG2URx4GGWY1R2jegX OdJA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from:dkim-signature; bh=gP4mGC+YUo6K0w0UpxWOLK3TlLTeraLNkmSSwz83nl8=; fh=jKU4eZ0CEFQaw0hsVcNTgC9Rma/J++T5hnbLLAaQBAQ=; b=FSBSRweKRlR2VhVyodKnQE39c3krbXZkyiaRCOHiSoi2vyAoEWUm/9JTDv07KrPRHM deZe8cRuOI80xZBJzs60PNsh8qp3ILGoC4eg+112lEUZNnjQn55EgnpSdh9ZUfvlEC5z Iecf3a1ze7k7H6/S5ObCVgHtbmPt9Dy/RcimJKOLLYYb1IwRjXk24QJYYoEINx8RtG9P oETPKlfEVcWnZM1TOxcku3S5rCsWz4ElsLmd+CY14O8FRoTRbOp+JW3mvKBymRtSz7cb PFjI7WUID8labJZLdkyq0yLdAQX9wr8xSKYjkUOh9S0x3a8JkOC2TyA/rT2Llx8jRyd8 n/mQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@intel.com header.s=Intel header.b=Bz0iL+yR; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.38 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=intel.com Received: from fry.vger.email (fry.vger.email. [23.128.96.38]) by mx.google.com with ESMTPS id v10-20020a17090a898a00b0028878f6a971si6121070pjn.99.2023.12.11.04.33.45 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 11 Dec 2023 04:33:46 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.38 as permitted sender) client-ip=23.128.96.38; Authentication-Results: mx.google.com; dkim=pass header.i=@intel.com header.s=Intel header.b=Bz0iL+yR; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.38 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=intel.com Received: from out1.vger.email (depot.vger.email [IPv6:2620:137:e000::3:0]) by fry.vger.email (Postfix) with ESMTP id 47E328096456; Mon, 11 Dec 2023 04:33:43 -0800 (PST) X-Virus-Status: Clean X-Virus-Scanned: clamav-milter 0.103.11 at fry.vger.email Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343499AbjLKMd1 (ORCPT <rfc822;dexuan.linux@gmail.com> + 99 others); Mon, 11 Dec 2023 07:33:27 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51522 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234834AbjLKMdZ (ORCPT <rfc822;linux-kernel@vger.kernel.org>); Mon, 11 Dec 2023 07:33:25 -0500 Received: from mgamail.intel.com (mgamail.intel.com [192.55.52.93]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C2BCA8E; Mon, 11 Dec 2023 04:33:31 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1702298011; x=1733834011; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=LkVViNkwO7QQP+f8k/J3d57xIdGBSObZp2X787WTBXs=; b=Bz0iL+yRQ4my/Xg8WPzBa8nIHN6ETCgKeA0PaAU7rwLBqh0xqG0MZApF a3nNbkEmp9x6mTX2FastmZ0x57K2RZxAVsHZEVR29JH9f108f2j0+1X3J w7cfNeMNejTZEIZd1+m9DUmiR0FhHK9A+HwqLDYhgsdlLt3BYNHyi+8kI zXeJt1/zRf3vXGXG4zLf6XQ+ITI7NyLY55e8UGxs/7O6yqep+K/V16GGZ opLvv6BRhQI+kUsCx1FKpyO9lGPpxKqzdTpwxNkdwUTj73VygGPola4X7 Ste8tYUiuTrU7axYDyQcUJDddK0Mym6TnbS5MriIasL8hsHWUgVwVzSbB w==; X-IronPort-AV: E=McAfee;i="6600,9927,10920"; a="391808850" X-IronPort-AV: E=Sophos;i="6.04,267,1695711600"; d="scan'208";a="391808850" Received: from orviesa001.jf.intel.com ([10.64.159.141]) by fmsmga102.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 11 Dec 2023 04:33:31 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.04,267,1695711600"; d="scan'208";a="21069107" Received: from newjersey.igk.intel.com ([10.102.20.203]) by orviesa001.jf.intel.com with ESMTP; 11 Dec 2023 04:33:28 -0800 From: Alexander Lobakin <aleksander.lobakin@intel.com> To: intel-wired-lan@lists.osuosl.org Cc: Alexander Lobakin <aleksander.lobakin@intel.com>, Michal Kubiak <michal.kubiak@intel.com>, Przemek Kitszel <przemyslaw.kitszel@intel.com>, Maciej Fijalkowski <maciej.fijalkowski@intel.com>, "David S. Miller" <davem@davemloft.net>, Eric Dumazet <edumazet@google.com>, Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>, Simon Horman <horms@kernel.org>, netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH iwl-net v2] idpf: fix corrupted frames and skb leaks in singleq mode Date: Mon, 11 Dec 2023 13:31:44 +0100 Message-ID: <20231211123144.3759488-1-aleksander.lobakin@intel.com> X-Mailer: git-send-email 2.43.0 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-0.9 required=5.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on fry.vger.email Precedence: bulk List-ID: <linux-kernel.vger.kernel.org> X-Mailing-List: linux-kernel@vger.kernel.org X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (fry.vger.email [0.0.0.0]); Mon, 11 Dec 2023 04:33:43 -0800 (PST) X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1784988855243880842 X-GMAIL-MSGID: 1784988855243880842 |
Series |
[iwl-net,v2] idpf: fix corrupted frames and skb leaks in singleq mode
|
|
Commit Message
Alexander Lobakin
Dec. 11, 2023, 12:31 p.m. UTC
idpf_ring::skb serves only for keeping an incomplete frame between several NAPI Rx polling cycles, as one cycle may end up before processing the end of packet descriptor. The pointer is taken from the ring onto the stack before entering the loop and gets written there after the loop exits. When inside the loop, only the onstack pointer is used. For some reason, the logics is broken in the singleq mode, where the pointer is taken from the ring each iteration. This means that if a frame got fragmented into several descriptors, each fragment will have its own skb, but only the last one will be passed up the stack (containing garbage), leaving the rest leaked. Then, on ifdown, rxq::skb is being freed only in the splitq mode, while it can point to a valid skb in singleq as well. This can lead to a yet another skb leak. Just don't touch the ring skb field inside the polling loop, letting the onstack skb pointer work as expected: build a new skb if it's the first frame descriptor and attach a frag otherwise. On ifdown, free rxq::skb unconditionally if the pointer is non-NULL. Fixes: a5ab9ee0df0b ("idpf: add singleq start_xmit and napi poll") Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com> Reviewed-by: Michal Kubiak <michal.kubiak@intel.com> Reviewed-by: Simon Horman <horms@kernel.org> Reviewed-by: Eric Dumazet <edumazet@google.com> Signed-off-by: Alexander Lobakin <aleksander.lobakin@intel.com> --- Tony, please add it to dev-queue instead of the first revision. From v1[0]: * fix the related skb leak on ifdown; * fix subject prefix; * pick Reviewed-bys. [0] https://lore.kernel.org/all/20231201143821.1091005-1-aleksander.lobakin@intel.com --- drivers/net/ethernet/intel/idpf/idpf_singleq_txrx.c | 1 - drivers/net/ethernet/intel/idpf/idpf_txrx.c | 2 +- 2 files changed, 1 insertion(+), 2 deletions(-)
Comments
> -----Original Message----- > From: Intel-wired-lan <intel-wired-lan-bounces@osuosl.org> On Behalf Of > Alexander Lobakin > Sent: Monday, December 11, 2023 4:32 AM > To: intel-wired-lan@lists.osuosl.org > Cc: Fijalkowski, Maciej <maciej.fijalkowski@intel.com>; Kitszel, Przemyslaw > <przemyslaw.kitszel@intel.com>; linux-kernel@vger.kernel.org; Lobakin, > Aleksander <aleksander.lobakin@intel.com>; Eric Dumazet > <edumazet@google.com>; Kubiak, Michal <michal.kubiak@intel.com>; > Simon Horman <horms@kernel.org>; netdev@vger.kernel.org; Jakub > Kicinski <kuba@kernel.org>; Paolo Abeni <pabeni@redhat.com>; David S. > Miller <davem@davemloft.net> > Subject: [Intel-wired-lan] [PATCH iwl-net v2] idpf: fix corrupted frames and > skb leaks in singleq mode > > idpf_ring::skb serves only for keeping an incomplete frame between > several NAPI Rx polling cycles, as one cycle may end up before > processing the end of packet descriptor. The pointer is taken from > the ring onto the stack before entering the loop and gets written > there after the loop exits. When inside the loop, only the onstack > pointer is used. > For some reason, the logics is broken in the singleq mode, where the > pointer is taken from the ring each iteration. This means that if a > frame got fragmented into several descriptors, each fragment will have > its own skb, but only the last one will be passed up the stack > (containing garbage), leaving the rest leaked. > Then, on ifdown, rxq::skb is being freed only in the splitq mode, while > it can point to a valid skb in singleq as well. This can lead to a yet > another skb leak. > Just don't touch the ring skb field inside the polling loop, letting > the onstack skb pointer work as expected: build a new skb if it's the > first frame descriptor and attach a frag otherwise. On ifdown, free > rxq::skb unconditionally if the pointer is non-NULL. > > Fixes: a5ab9ee0df0b ("idpf: add singleq start_xmit and napi poll") > Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com> > Reviewed-by: Michal Kubiak <michal.kubiak@intel.com> > Reviewed-by: Simon Horman <horms@kernel.org> > Reviewed-by: Eric Dumazet <edumazet@google.com> > Signed-off-by: Alexander Lobakin <aleksander.lobakin@intel.com> > --- > Tony, please add it to dev-queue instead of the first revision. > > From v1[0]: > * fix the related skb leak on ifdown; > * fix subject prefix; > * pick Reviewed-bys. > > [0] https://lore.kernel.org/all/20231201143821.1091005-1- > aleksander.lobakin@intel.com > --- > drivers/net/ethernet/intel/idpf/idpf_singleq_txrx.c | 1 - > drivers/net/ethernet/intel/idpf/idpf_txrx.c | 2 +- > 2 files changed, 1 insertion(+), 2 deletions(-) Tested-by: Scott Register <scott.register@intel.com>
diff --git a/drivers/net/ethernet/intel/idpf/idpf_singleq_txrx.c b/drivers/net/ethernet/intel/idpf/idpf_singleq_txrx.c index 81288a17da2a..20c4b3a64710 100644 --- a/drivers/net/ethernet/intel/idpf/idpf_singleq_txrx.c +++ b/drivers/net/ethernet/intel/idpf/idpf_singleq_txrx.c @@ -1044,7 +1044,6 @@ static int idpf_rx_singleq_clean(struct idpf_queue *rx_q, int budget) } idpf_rx_sync_for_cpu(rx_buf, fields.size); - skb = rx_q->skb; if (skb) idpf_rx_add_frag(rx_buf, skb, fields.size); else diff --git a/drivers/net/ethernet/intel/idpf/idpf_txrx.c b/drivers/net/ethernet/intel/idpf/idpf_txrx.c index 1f728a9004d9..9e942e5baf39 100644 --- a/drivers/net/ethernet/intel/idpf/idpf_txrx.c +++ b/drivers/net/ethernet/intel/idpf/idpf_txrx.c @@ -396,7 +396,7 @@ static void idpf_rx_desc_rel(struct idpf_queue *rxq, bool bufq, s32 q_model) if (!rxq) return; - if (!bufq && idpf_is_queue_model_split(q_model) && rxq->skb) { + if (rxq->skb) { dev_kfree_skb_any(rxq->skb); rxq->skb = NULL; }