Message ID | 20200825091629.12949-3-bjorn.topel@gmail.com |
---|---|
State | Awaiting Upstream |
Delegated to: | David Miller |
Headers | show |
Series | Avoid premature Rx buffer reuse for XDP_REDIRECT | expand |
> -----Original Message----- > From: Björn Töpel [mailto:bjorn.topel@gmail.com] > Sent: Tuesday, August 25, 2020 5:16 PM > To: jeffrey.t.kirsher@intel.com; intel-wired-lan@lists.osuosl.org > Cc: Björn Töpel <bjorn.topel@intel.com>; magnus.karlsson@intel.com; > magnus.karlsson@gmail.com; netdev@vger.kernel.org; > maciej.fijalkowski@intel.com; piotr.raczynski@intel.com; > maciej.machnikowski@intel.com; Li,Rongqing <lirongqing@baidu.com> > Subject: [PATCH net 2/3] ixgbe: avoid premature Rx buffer reuse > > From: Björn Töpel <bjorn.topel@intel.com> > > The page recycle code, incorrectly, relied on that a page fragment could not be > freed inside xdp_do_redirect(). This assumption leads to that page fragments > that are used by the stack/XDP redirect can be reused and overwritten. > > To avoid this, store the page count prior invoking xdp_do_redirect(). > > Fixes: 6453073987ba ("ixgbe: add initial support for xdp redirect") > Signed-off-by: Björn Töpel <bjorn.topel@intel.com> Reported-and-analyzed-by: Li RongQing <lirongqing@baidu.com> Thanks -Li
On 2020-08-25 11:55, Li,Rongqing wrote: > > >> -----Original Message----- >> From: Björn Töpel [mailto:bjorn.topel@gmail.com] >> Sent: Tuesday, August 25, 2020 5:16 PM >> To: jeffrey.t.kirsher@intel.com; intel-wired-lan@lists.osuosl.org >> Cc: Björn Töpel <bjorn.topel@intel.com>; magnus.karlsson@intel.com; >> magnus.karlsson@gmail.com; netdev@vger.kernel.org; >> maciej.fijalkowski@intel.com; piotr.raczynski@intel.com; >> maciej.machnikowski@intel.com; Li,Rongqing <lirongqing@baidu.com> >> Subject: [PATCH net 2/3] ixgbe: avoid premature Rx buffer reuse >> >> From: Björn Töpel <bjorn.topel@intel.com> >> >> The page recycle code, incorrectly, relied on that a page fragment could not be >> freed inside xdp_do_redirect(). This assumption leads to that page fragments >> that are used by the stack/XDP redirect can be reused and overwritten. >> >> To avoid this, store the page count prior invoking xdp_do_redirect(). >> >> Fixes: 6453073987ba ("ixgbe: add initial support for xdp redirect") >> Signed-off-by: Björn Töpel <bjorn.topel@intel.com> > > Reported-and-analyzed-by: Li RongQing <lirongqing@baidu.com> > Thanks Li! I should have added that. Intel-folks, please make sure Li's tags for ixgbe/ice are added. Björn > Thanks > > -Li >
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c index 2f8a4cfc5fa1..fb5c311d72b6 100644 --- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c @@ -1945,7 +1945,8 @@ static inline bool ixgbe_page_is_reserved(struct page *page) return (page_to_nid(page) != numa_mem_id()) || page_is_pfmemalloc(page); } -static bool ixgbe_can_reuse_rx_page(struct ixgbe_rx_buffer *rx_buffer) +static bool ixgbe_can_reuse_rx_page(struct ixgbe_rx_buffer *rx_buffer, + int rx_buffer_pgcnt) { unsigned int pagecnt_bias = rx_buffer->pagecnt_bias; struct page *page = rx_buffer->page; @@ -1956,7 +1957,7 @@ static bool ixgbe_can_reuse_rx_page(struct ixgbe_rx_buffer *rx_buffer) #if (PAGE_SIZE < 8192) /* if we are only owner of page we can reuse it */ - if (unlikely((page_ref_count(page) - pagecnt_bias) > 1)) + if (unlikely((rx_buffer_pgcnt - pagecnt_bias) > 1)) return false; #else /* The last offset is a bit aggressive in that we assume the @@ -2018,14 +2019,25 @@ static void ixgbe_add_rx_frag(struct ixgbe_ring *rx_ring, #endif } +static int ixgbe_rx_buffer_page_count(struct ixgbe_rx_buffer *rx_buffer) +{ +#if (PAGE_SIZE < 8192) + return page_count(rx_buffer->page); +#else + return 0; +#endif +} + static struct ixgbe_rx_buffer *ixgbe_get_rx_buffer(struct ixgbe_ring *rx_ring, union ixgbe_adv_rx_desc *rx_desc, struct sk_buff **skb, - const unsigned int size) + const unsigned int size, + int *rx_buffer_pgcnt) { struct ixgbe_rx_buffer *rx_buffer; rx_buffer = &rx_ring->rx_buffer_info[rx_ring->next_to_clean]; + *rx_buffer_pgcnt = ixgbe_rx_buffer_page_count(rx_buffer); prefetchw(rx_buffer->page); *skb = rx_buffer->skb; @@ -2055,9 +2067,10 @@ static struct ixgbe_rx_buffer *ixgbe_get_rx_buffer(struct ixgbe_ring *rx_ring, static void ixgbe_put_rx_buffer(struct ixgbe_ring *rx_ring, struct ixgbe_rx_buffer *rx_buffer, - struct sk_buff *skb) + struct sk_buff *skb, + int rx_buffer_pgcnt) { - if (ixgbe_can_reuse_rx_page(rx_buffer)) { + if (ixgbe_can_reuse_rx_page(rx_buffer, rx_buffer_pgcnt)) { /* hand second half of page back to the ring */ ixgbe_reuse_rx_page(rx_ring, rx_buffer); } else { @@ -2296,6 +2309,7 @@ static int ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector, u16 cleaned_count = ixgbe_desc_unused(rx_ring); unsigned int xdp_xmit = 0; struct xdp_buff xdp; + int rx_buffer_pgcnt; xdp.rxq = &rx_ring->xdp_rxq; @@ -2327,7 +2341,7 @@ static int ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector, */ dma_rmb(); - rx_buffer = ixgbe_get_rx_buffer(rx_ring, rx_desc, &skb, size); + rx_buffer = ixgbe_get_rx_buffer(rx_ring, rx_desc, &skb, size, &rx_buffer_pgcnt); /* retrieve a buffer from the ring */ if (!skb) { @@ -2372,7 +2386,7 @@ static int ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector, break; } - ixgbe_put_rx_buffer(rx_ring, rx_buffer, skb); + ixgbe_put_rx_buffer(rx_ring, rx_buffer, skb, rx_buffer_pgcnt); cleaned_count++; /* place incomplete frames back on ring for completion */