mirror of
https://github.com/edk2-porting/linux-next.git
synced 2024-12-24 05:04:00 +08:00
ixgbevf: Fix multiple issues in ixgbevf_get/set_ringparam
In ixgbevf_get_ringparam we could run into a NULL pointer dereference if the rings were not allocated when we attempted the call. To prevent that we can just access the tx/rx_ring_count values instead of attempting to access the rings to get the count. This change corrects a memory leak and memory corruption in ixgbevf_set_ringparam. The memory leak was due to us not freeing the resources from the ring before overwriting them. This change corrects the memory leak by making certain to call ixgbe_free_tx/rx_resources on the rings prior to freeing them. The memory corruption was because we were replacing the rings but not updating the q_vectors. It addresses the memory corruption by leaving the rings in place and instead just copying the contents of the new rings into the existing rings. Signed-off-by: Alexander Duyck <alexander.h.duyck@intel.com> Acked-by: Greg Rose <gregory.v.rose@intel.com> Tested-by: Sibai Li <sibai.li@intel.com> Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
This commit is contained in:
parent
70a10e258c
commit
eb022d058f
@ -284,13 +284,11 @@ static void ixgbevf_get_ringparam(struct net_device *netdev,
|
||||
struct ethtool_ringparam *ring)
|
||||
{
|
||||
struct ixgbevf_adapter *adapter = netdev_priv(netdev);
|
||||
struct ixgbevf_ring *tx_ring = adapter->tx_ring;
|
||||
struct ixgbevf_ring *rx_ring = adapter->rx_ring;
|
||||
|
||||
ring->rx_max_pending = IXGBEVF_MAX_RXD;
|
||||
ring->tx_max_pending = IXGBEVF_MAX_TXD;
|
||||
ring->rx_pending = rx_ring->count;
|
||||
ring->tx_pending = tx_ring->count;
|
||||
ring->rx_pending = adapter->rx_ring_count;
|
||||
ring->tx_pending = adapter->tx_ring_count;
|
||||
}
|
||||
|
||||
static int ixgbevf_set_ringparam(struct net_device *netdev,
|
||||
@ -298,33 +296,28 @@ static int ixgbevf_set_ringparam(struct net_device *netdev,
|
||||
{
|
||||
struct ixgbevf_adapter *adapter = netdev_priv(netdev);
|
||||
struct ixgbevf_ring *tx_ring = NULL, *rx_ring = NULL;
|
||||
int i, err = 0;
|
||||
u32 new_rx_count, new_tx_count;
|
||||
int i, err = 0;
|
||||
|
||||
if ((ring->rx_mini_pending) || (ring->rx_jumbo_pending))
|
||||
return -EINVAL;
|
||||
|
||||
new_rx_count = max(ring->rx_pending, (u32)IXGBEVF_MIN_RXD);
|
||||
new_rx_count = min(new_rx_count, (u32)IXGBEVF_MAX_RXD);
|
||||
new_rx_count = ALIGN(new_rx_count, IXGBE_REQ_RX_DESCRIPTOR_MULTIPLE);
|
||||
|
||||
new_tx_count = max(ring->tx_pending, (u32)IXGBEVF_MIN_TXD);
|
||||
new_tx_count = min(new_tx_count, (u32)IXGBEVF_MAX_TXD);
|
||||
new_tx_count = max_t(u32, ring->tx_pending, IXGBEVF_MIN_TXD);
|
||||
new_tx_count = min_t(u32, new_tx_count, IXGBEVF_MAX_TXD);
|
||||
new_tx_count = ALIGN(new_tx_count, IXGBE_REQ_TX_DESCRIPTOR_MULTIPLE);
|
||||
|
||||
if ((new_tx_count == adapter->tx_ring->count) &&
|
||||
(new_rx_count == adapter->rx_ring->count)) {
|
||||
/* nothing to do */
|
||||
new_rx_count = max_t(u32, ring->rx_pending, IXGBEVF_MIN_RXD);
|
||||
new_rx_count = min_t(u32, new_rx_count, IXGBEVF_MAX_RXD);
|
||||
new_rx_count = ALIGN(new_rx_count, IXGBE_REQ_RX_DESCRIPTOR_MULTIPLE);
|
||||
|
||||
/* if nothing to do return success */
|
||||
if ((new_tx_count == adapter->tx_ring_count) &&
|
||||
(new_rx_count == adapter->rx_ring_count))
|
||||
return 0;
|
||||
}
|
||||
|
||||
while (test_and_set_bit(__IXGBEVF_RESETTING, &adapter->state))
|
||||
msleep(1);
|
||||
usleep_range(1000, 2000);
|
||||
|
||||
/*
|
||||
* If the adapter isn't up and running then just set the
|
||||
* new parameters and scurry for the exits.
|
||||
*/
|
||||
if (!netif_running(adapter->netdev)) {
|
||||
for (i = 0; i < adapter->num_tx_queues; i++)
|
||||
adapter->tx_ring[i].count = new_tx_count;
|
||||
@ -335,78 +328,98 @@ static int ixgbevf_set_ringparam(struct net_device *netdev,
|
||||
goto clear_reset;
|
||||
}
|
||||
|
||||
tx_ring = kcalloc(adapter->num_tx_queues,
|
||||
sizeof(struct ixgbevf_ring), GFP_KERNEL);
|
||||
if (!tx_ring) {
|
||||
err = -ENOMEM;
|
||||
goto clear_reset;
|
||||
}
|
||||
if (new_tx_count != adapter->tx_ring_count) {
|
||||
tx_ring = vmalloc(adapter->num_tx_queues * sizeof(*tx_ring));
|
||||
if (!tx_ring) {
|
||||
err = -ENOMEM;
|
||||
goto clear_reset;
|
||||
}
|
||||
|
||||
rx_ring = kcalloc(adapter->num_rx_queues,
|
||||
sizeof(struct ixgbevf_ring), GFP_KERNEL);
|
||||
if (!rx_ring) {
|
||||
err = -ENOMEM;
|
||||
goto err_rx_setup;
|
||||
}
|
||||
|
||||
ixgbevf_down(adapter);
|
||||
|
||||
memcpy(tx_ring, adapter->tx_ring,
|
||||
adapter->num_tx_queues * sizeof(struct ixgbevf_ring));
|
||||
for (i = 0; i < adapter->num_tx_queues; i++) {
|
||||
tx_ring[i].count = new_tx_count;
|
||||
err = ixgbevf_setup_tx_resources(adapter, &tx_ring[i]);
|
||||
if (err) {
|
||||
for (i = 0; i < adapter->num_tx_queues; i++) {
|
||||
/* clone ring and setup updated count */
|
||||
tx_ring[i] = adapter->tx_ring[i];
|
||||
tx_ring[i].count = new_tx_count;
|
||||
err = ixgbevf_setup_tx_resources(adapter, &tx_ring[i]);
|
||||
if (!err)
|
||||
continue;
|
||||
while (i) {
|
||||
i--;
|
||||
ixgbevf_free_tx_resources(adapter, &tx_ring[i]);
|
||||
}
|
||||
goto err_tx_ring_setup;
|
||||
|
||||
vfree(tx_ring);
|
||||
tx_ring = NULL;
|
||||
|
||||
goto clear_reset;
|
||||
}
|
||||
}
|
||||
|
||||
memcpy(rx_ring, adapter->rx_ring,
|
||||
adapter->num_rx_queues * sizeof(struct ixgbevf_ring));
|
||||
for (i = 0; i < adapter->num_rx_queues; i++) {
|
||||
rx_ring[i].count = new_rx_count;
|
||||
err = ixgbevf_setup_rx_resources(adapter, &rx_ring[i]);
|
||||
if (err) {
|
||||
if (new_rx_count != adapter->rx_ring_count) {
|
||||
rx_ring = vmalloc(adapter->num_rx_queues * sizeof(*rx_ring));
|
||||
if (!rx_ring) {
|
||||
err = -ENOMEM;
|
||||
goto clear_reset;
|
||||
}
|
||||
|
||||
for (i = 0; i < adapter->num_rx_queues; i++) {
|
||||
/* clone ring and setup updated count */
|
||||
rx_ring[i] = adapter->rx_ring[i];
|
||||
rx_ring[i].count = new_rx_count;
|
||||
err = ixgbevf_setup_rx_resources(adapter, &rx_ring[i]);
|
||||
if (!err)
|
||||
continue;
|
||||
while (i) {
|
||||
i--;
|
||||
ixgbevf_free_rx_resources(adapter, &rx_ring[i]);
|
||||
}
|
||||
goto err_rx_ring_setup;
|
||||
|
||||
vfree(rx_ring);
|
||||
rx_ring = NULL;
|
||||
|
||||
goto clear_reset;
|
||||
}
|
||||
}
|
||||
|
||||
/*
|
||||
* Only switch to new rings if all the prior allocations
|
||||
* and ring setups have succeeded.
|
||||
*/
|
||||
kfree(adapter->tx_ring);
|
||||
adapter->tx_ring = tx_ring;
|
||||
adapter->tx_ring_count = new_tx_count;
|
||||
/* bring interface down to prepare for update */
|
||||
ixgbevf_down(adapter);
|
||||
|
||||
kfree(adapter->rx_ring);
|
||||
adapter->rx_ring = rx_ring;
|
||||
adapter->rx_ring_count = new_rx_count;
|
||||
/* Tx */
|
||||
if (tx_ring) {
|
||||
for (i = 0; i < adapter->num_tx_queues; i++) {
|
||||
ixgbevf_free_tx_resources(adapter,
|
||||
&adapter->tx_ring[i]);
|
||||
adapter->tx_ring[i] = tx_ring[i];
|
||||
}
|
||||
adapter->tx_ring_count = new_tx_count;
|
||||
|
||||
/* success! */
|
||||
vfree(tx_ring);
|
||||
tx_ring = NULL;
|
||||
}
|
||||
|
||||
/* Rx */
|
||||
if (rx_ring) {
|
||||
for (i = 0; i < adapter->num_rx_queues; i++) {
|
||||
ixgbevf_free_rx_resources(adapter,
|
||||
&adapter->rx_ring[i]);
|
||||
adapter->rx_ring[i] = rx_ring[i];
|
||||
}
|
||||
adapter->rx_ring_count = new_rx_count;
|
||||
|
||||
vfree(rx_ring);
|
||||
rx_ring = NULL;
|
||||
}
|
||||
|
||||
/* restore interface using new values */
|
||||
ixgbevf_up(adapter);
|
||||
|
||||
goto clear_reset;
|
||||
|
||||
err_rx_ring_setup:
|
||||
for(i = 0; i < adapter->num_tx_queues; i++)
|
||||
ixgbevf_free_tx_resources(adapter, &tx_ring[i]);
|
||||
|
||||
err_tx_ring_setup:
|
||||
kfree(rx_ring);
|
||||
|
||||
err_rx_setup:
|
||||
kfree(tx_ring);
|
||||
|
||||
clear_reset:
|
||||
/* free Tx resources if Rx error is encountered */
|
||||
if (tx_ring) {
|
||||
for (i = 0; i < adapter->num_tx_queues; i++)
|
||||
ixgbevf_free_tx_resources(adapter, &tx_ring[i]);
|
||||
vfree(tx_ring);
|
||||
}
|
||||
|
||||
clear_bit(__IXGBEVF_RESETTING, &adapter->state);
|
||||
return err;
|
||||
}
|
||||
|
Loading…
Reference in New Issue
Block a user