From patchwork Tue Sep 8 08:52:44 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dmitry Vyukov X-Patchwork-Id: 515949 X-Patchwork-Delegate: jeffrey.t.kirsher@intel.com Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from fraxinus.osuosl.org (smtp4.osuosl.org [140.211.166.137]) by ozlabs.org (Postfix) with ESMTP id CE2B7140291 for ; Thu, 10 Sep 2015 03:32:55 +1000 (AEST) Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=google.com header.i=@google.com header.b=OsUnf8fE; dkim-atps=neutral Received: from localhost (localhost [127.0.0.1]) by fraxinus.osuosl.org (Postfix) with ESMTP id 29C8E86CE1; Wed, 9 Sep 2015 17:32:55 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from fraxinus.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zp24x4M6cqmj; Wed, 9 Sep 2015 17:32:54 +0000 (UTC) Received: from ash.osuosl.org (ash.osuosl.org [140.211.166.34]) by fraxinus.osuosl.org (Postfix) with ESMTP id 350A18764C; Wed, 9 Sep 2015 17:32:54 +0000 (UTC) X-Original-To: intel-wired-lan@lists.osuosl.org Delivered-To: intel-wired-lan@lists.osuosl.org Received: from hemlock.osuosl.org (smtp2.osuosl.org [140.211.166.133]) by ash.osuosl.org (Postfix) with ESMTP id 289B71C162E for ; Tue, 8 Sep 2015 08:52:52 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by hemlock.osuosl.org (Postfix) with ESMTP id 22D02960D9 for ; Tue, 8 Sep 2015 08:52:52 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from hemlock.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MFE56IUYo7tC for ; Tue, 8 Sep 2015 08:52:51 +0000 (UTC) X-Greylist: domain auto-whitelisted by SQLgrey-1.7.6 Received: from mail-wi0-f180.google.com (mail-wi0-f180.google.com [209.85.212.180]) by hemlock.osuosl.org (Postfix) with ESMTPS id 340FC960D5 for ; Tue, 8 Sep 2015 08:52:51 +0000 (UTC) Received: by wicge5 with SMTP id ge5so107556880wic.0 for ; Tue, 08 Sep 2015 01:52:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=GVzMB0/B8WAHYyEqUS1CeXnhoZlo/+kv3lVlGtdgvWY=; b=OsUnf8fEhUcYyxYKSnYtSSA/BcZcmq2xUTRzpVvOpBnpBZgvj8xCnY3ZbR92XCU/0h Xr6DMz6SrIkFeYqYuGib9U9C8XJ11hHvwSWrIF4koHt5OALcrIPrnkFHg6Dia24rMpdI NJCG3Ctcu3iSbCarN3x07w7UPbf/JA5RDfu2Sg+HYsILpRlBRREsf9v6PbWGYME4oOoG TTf2CVBhD7TcbmWYRrG6YpLWQMqA1hnkhiQvhEMxuhkyNYA+gECQtMcABiYTAfyiUDdu 6/cPMAXnQIFbPj+aaAsB3mhpyGgfw+dm1YwSZ2MBEggphrOvzEIjKu3Xpxd+D+pqdrrT zN3Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=GVzMB0/B8WAHYyEqUS1CeXnhoZlo/+kv3lVlGtdgvWY=; b=Inh2YeWPWGZg8JkPFju/gbZFrzZWrECcKw0wyiOZ87ch3uf3nUKZbb6Rw6cZO1LhdR /VMAOzW5vxPaJruhEjobLzoV10vEvBOHrZMaZnn4sajRqaIs59UpVebJTYisBfo1PlZi 0mOCiprcNb3fZi05lJcGIoHZpriCsBB8FzJ+xD36DetIack5VTd2tRBEWWw2uKvpmoVA cJU4yHvlFSu7FMcBBst4ajlfl3SLeoiYbaQobVunClmruuOpHxo1OL20f6C7w2tKDfAV R4mxDkVpglOCQLq0yPAnrXqxyCzDZPPusNvvviJiI7NMUlNbElzl5pln+3XlGI0DCI++ qN0Q== X-Gm-Message-State: ALoCoQlFKH5NU6r1BIkIBmc61NcJsMK07/ja3To2dmfZZ7tJuA0kpKLCWkthVwrRJjtM1Rky3gCt X-Received: by 10.194.238.202 with SMTP id vm10mr36589697wjc.96.1441702369378; Tue, 08 Sep 2015 01:52:49 -0700 (PDT) Received: from dvyukov-z840.muc.corp.google.com ([172.18.0.115]) by smtp.gmail.com with ESMTPSA id gt4sm4531616wib.21.2015.09.08.01.52.48 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 08 Sep 2015 01:52:48 -0700 (PDT) Received: by dvyukov-z840.muc.corp.google.com (Postfix, from userid 129372) id 6747FE1145; Tue, 8 Sep 2015 10:52:47 +0200 (CEST) From: Dmitry Vyukov To: jeffrey.t.kirsher@intel.com, jesse.brandeburg@intel.com, shannon.nelson@intel.com, carolyn.wyborny@intel.com, donald.c.skidmore@intel.com, matthew.vick@intel.com, john.ronciak@intel.com, mitch.a.williams@intel.com Date: Tue, 8 Sep 2015 10:52:44 +0200 Message-Id: <1441702364-46366-1-git-send-email-dvyukov@google.com> X-Mailer: git-send-email 2.5.0.457.gab17608 In-Reply-To: References: X-Mailman-Approved-At: Wed, 09 Sep 2015 17:32:52 +0000 Cc: andreyknvl@google.com, kcc@google.com, glider@google.com, intel-wired-lan@lists.osuosl.org, ktsan@googlegroups.com, Dmitry Vyukov Subject: [Intel-wired-lan] [PATCH] e1000: fix data race between tx_ring->next_to_clean X-BeenThere: intel-wired-lan@lists.osuosl.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: Intel Wired Ethernet Linux Kernel Driver Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: intel-wired-lan-bounces@lists.osuosl.org Sender: "Intel-wired-lan" e1000_clean_tx_irq cleans buffers and sets tx_ring->next_to_clean, then e1000_xmit_frame reuses the cleaned buffers. But there are no memory barriers when buffers gets recycled, so the recycled buffers can be corrupted. Use smp_store_release to update tx_ring->next_to_clean and smp_load_acquire to read tx_ring->next_to_clean to properly hand off buffers from e1000_clean_tx_irq to e1000_xmit_frame. The data race was found with KernelThreadSanitizer (KTSAN). Signed-off-by: Dmitry Vyukov --- drivers/net/ethernet/intel/e1000/e1000.h | 7 +++++-- drivers/net/ethernet/intel/e1000/e1000_main.c | 5 ++++- 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/drivers/net/ethernet/intel/e1000/e1000.h b/drivers/net/ethernet/intel/e1000/e1000.h index 6970710..98fe5a2 100644 --- a/drivers/net/ethernet/intel/e1000/e1000.h +++ b/drivers/net/ethernet/intel/e1000/e1000.h @@ -213,8 +213,11 @@ struct e1000_rx_ring { }; #define E1000_DESC_UNUSED(R) \ - ((((R)->next_to_clean > (R)->next_to_use) \ - ? 0 : (R)->count) + (R)->next_to_clean - (R)->next_to_use - 1) +({ \ + unsigned int clean = smp_load_acquire(&(R)->next_to_clean); \ + unsigned int use = READ_ONCE((R)->next_to_use); \ + (clean > use ? 0 : (R)->count) + clean - use - 1; \ +}) #define E1000_RX_DESC_EXT(R, i) \ (&(((union e1000_rx_desc_extended *)((R).desc))[i])) diff --git a/drivers/net/ethernet/intel/e1000/e1000_main.c b/drivers/net/ethernet/intel/e1000/e1000_main.c index 74dc150..97e38ce 100644 --- a/drivers/net/ethernet/intel/e1000/e1000_main.c +++ b/drivers/net/ethernet/intel/e1000/e1000_main.c @@ -3876,7 +3876,10 @@ static bool e1000_clean_tx_irq(struct e1000_adapter *adapter, eop_desc = E1000_TX_DESC(*tx_ring, eop); } - tx_ring->next_to_clean = i; + /* Synchronize with E1000_DESC_UNUSED called from e1000_xmit_frame, + * which will reuse the cleaned buffers. + */ + smp_store_release(&tx_ring->next_to_clean, i); netdev_completed_queue(netdev, pkts_compl, bytes_compl);