From patchwork Mon Sep 7 18:12:41 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dmitry Vyukov X-Patchwork-Id: 515948 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from fraxinus.osuosl.org (smtp4.osuosl.org [140.211.166.137]) by ozlabs.org (Postfix) with ESMTP id 540A814028F for ; Thu, 10 Sep 2015 03:32:55 +1000 (AEST) Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=google.com header.i=@google.com header.b=WrPvTmu6; dkim-atps=neutral Received: from localhost (localhost [127.0.0.1]) by fraxinus.osuosl.org (Postfix) with ESMTP id 7D66287667; Wed, 9 Sep 2015 17:32:54 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from fraxinus.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zoIOAs3USlxq; Wed, 9 Sep 2015 17:32:54 +0000 (UTC) Received: from ash.osuosl.org (ash.osuosl.org [140.211.166.34]) by fraxinus.osuosl.org (Postfix) with ESMTP id F1BB385B22; Wed, 9 Sep 2015 17:32:53 +0000 (UTC) X-Original-To: intel-wired-lan@lists.osuosl.org Delivered-To: intel-wired-lan@lists.osuosl.org Received: from fraxinus.osuosl.org (smtp4.osuosl.org [140.211.166.137]) by ash.osuosl.org (Postfix) with ESMTP id 03F731C1620 for ; Mon, 7 Sep 2015 18:12:47 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by fraxinus.osuosl.org (Postfix) with ESMTP id 00193A2F3B for ; Mon, 7 Sep 2015 18:12:46 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from fraxinus.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id w2RmMQ5648GT for ; Mon, 7 Sep 2015 18:12:46 +0000 (UTC) X-Greylist: domain auto-whitelisted by SQLgrey-1.7.6 Received: from mail-wi0-f175.google.com (mail-wi0-f175.google.com [209.85.212.175]) by fraxinus.osuosl.org (Postfix) with ESMTPS id 2F1F2A2EF1 for ; Mon, 7 Sep 2015 18:12:46 +0000 (UTC) Received: by wiclk2 with SMTP id lk2so91477089wic.1 for ; Mon, 07 Sep 2015 11:12:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=from:to:cc:subject:date:message-id; bh=8KA7CQvWLVV4GJUngyFU4eNYty5yQjZnSvcgoNYhAos=; b=WrPvTmu6W1E/ycpoOa9YlwE1Yxhl7ZJa04GYzXT/e00UJ4jBoXVYfbOiAtyoXayXCn pPclip+hw/8mhJUdevZMsoc/aqrUdNxkuiGkDC0W84EJadTBGIgghG4gN8AhlabvowDH KM+UxK0FEl408LbpKED4gLgnYDiJx1Z5PVFK/3mEHUNqOjMFamMwt4+BDBwFwkLRTjTe k/yHZzstVHwyXqnphwXUB5XLxm7toV5k0290lzfXiBxwD75N5Dvldham2uYDC4n/xK0F kHe/NybX5ofP1F6ceuUs//Tf9FJkCbCzabB0S8Yv+ZAh61yuIa3GA4MGu3ZZo8BDf0Zo QSZg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=8KA7CQvWLVV4GJUngyFU4eNYty5yQjZnSvcgoNYhAos=; b=AfqAOUKMc5hmVNy1clqchs033ZuydMs+nGTJJnic3/2H/OSMCdSo11huWy+PuZCqAD j1Cth9CKGLRt+JwY8rDhJFRKJNuB3odGuCsyEFOxfHjpM1nPpFQfRsy5Fyjmbmr97uHr vSUNT/xsi3iPFB8rYhAVmenY1EQQre/S9dicpg/YJQM9tB33URgIacw9oo0FRvjHkFlW 24UW/iK+eHOlilrL5/e3CqUhrExpPLODJaZ3w3EXIHHItaPb6cGnR3l29zxRoU7a0bkO 8pfQqJt1vb2XjdPpa73GLsEaGk5sr+xrAmiMGfroGWm3GsFNj2r6bJ8Ohezi/R6gs+3d kHJQ== X-Gm-Message-State: ALoCoQl4d6JSI8KALKpZJCc3ZidGydbX2LkwaAJV/veU+emHL95mcfFaLJMkeidbtaqPp21Zl+Tu X-Received: by 10.180.20.15 with SMTP id j15mr36888197wie.76.1441649564599; Mon, 07 Sep 2015 11:12:44 -0700 (PDT) Received: from dvyukov-z840.muc.corp.google.com ([2620:0:1046:0:556:1128:3ec9:4304]) by smtp.gmail.com with ESMTPSA id t7sm631458wia.9.2015.09.07.11.12.43 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 07 Sep 2015 11:12:43 -0700 (PDT) Received: by dvyukov-z840.muc.corp.google.com (Postfix, from userid 129372) id 7EC8BE1145; Mon, 7 Sep 2015 20:12:42 +0200 (CEST) From: Dmitry Vyukov To: jeffrey.t.kirsher@intel.com, jesse.brandeburg@intel.com, shannon.nelson@intel.com, carolyn.wyborny@intel.com, donald.c.skidmore@intel.com, matthew.vick@intel.com, john.ronciak@intel.com, mitch.a.williams@intel.com Date: Mon, 7 Sep 2015 20:12:41 +0200 Message-Id: <1441649561-143084-1-git-send-email-dvyukov@google.com> X-Mailer: git-send-email 2.5.0.457.gab17608 X-Mailman-Approved-At: Wed, 09 Sep 2015 17:32:52 +0000 Cc: andreyknvl@google.com, kcc@google.com, glider@google.com, intel-wired-lan@lists.osuosl.org, ktsan@googlegroups.com, Dmitry Vyukov Subject: [Intel-wired-lan] [PATCH] e1000: fix data race between tx_ring->next_to_clean X-BeenThere: intel-wired-lan@lists.osuosl.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: Intel Wired Ethernet Linux Kernel Driver Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: intel-wired-lan-bounces@lists.osuosl.org Sender: "Intel-wired-lan" e1000_clean_tx_irq cleans buffers and sets tx_ring->next_to_clean, then e1000_xmit_frame reuses the cleaned buffers. But there are no memory barriers when buffers gets recycled, so the recycled buffers can be corrupted. Use smp_store_release to update tx_ring->next_to_clean and smp_load_acquire to read tx_ring->next_to_clean to properly hand off buffers from e1000_clean_tx_irq to e1000_xmit_frame. The data race was found with KernelThreadSanitizer (KTSAN). Signed-off-by: Dmitry Vyukov --- drivers/net/ethernet/intel/e1000/e1000.h | 7 +++++-- drivers/net/ethernet/intel/e1000/e1000_main.c | 5 ++++- 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/drivers/net/ethernet/intel/e1000/e1000.h b/drivers/net/ethernet/intel/e1000/e1000.h index 6970710..244c0e7 100644 --- a/drivers/net/ethernet/intel/e1000/e1000.h +++ b/drivers/net/ethernet/intel/e1000/e1000.h @@ -213,8 +213,11 @@ struct e1000_rx_ring { }; #define E1000_DESC_UNUSED(R) \ - ((((R)->next_to_clean > (R)->next_to_use) \ - ? 0 : (R)->count) + (R)->next_to_clean - (R)->next_to_use - 1) +({ \ + unsigned int clean = smp_load_acquire(&(R)->next_to_clean); \ + unsigned int use = READ_ONCE((R)->next_to_use); \ + clean > use ? 0 : (R)->count + clean - use - 1; \ +}) #define E1000_RX_DESC_EXT(R, i) \ (&(((union e1000_rx_desc_extended *)((R).desc))[i])) diff --git a/drivers/net/ethernet/intel/e1000/e1000_main.c b/drivers/net/ethernet/intel/e1000/e1000_main.c index 74dc150..97e38ce 100644 --- a/drivers/net/ethernet/intel/e1000/e1000_main.c +++ b/drivers/net/ethernet/intel/e1000/e1000_main.c @@ -3876,7 +3876,10 @@ static bool e1000_clean_tx_irq(struct e1000_adapter *adapter, eop_desc = E1000_TX_DESC(*tx_ring, eop); } - tx_ring->next_to_clean = i; + /* Synchronize with E1000_DESC_UNUSED called from e1000_xmit_frame, + * which will reuse the cleaned buffers. + */ + smp_store_release(&tx_ring->next_to_clean, i); netdev_completed_queue(netdev, pkts_compl, bytes_compl);