Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit eb022d05 authored by Alexander Duyck's avatar Alexander Duyck Committed by Jeff Kirsher
Browse files

ixgbevf: Fix multiple issues in ixgbevf_get/set_ringparam 



In ixgbevf_get_ringparam we could run into a NULL pointer dereference
if the rings were not allocated when we attempted the call.  To prevent
that we can just access the tx/rx_ring_count values instead of attempting
to access the rings to get the count.

This change corrects a memory leak and memory corruption in
ixgbevf_set_ringparam.

The memory leak was due to us not freeing the resources from the ring
before overwriting them.  This change corrects the memory leak by making
certain to call ixgbe_free_tx/rx_resources on the rings prior to freeing
them.

The memory corruption was because we were replacing the rings but not
updating the q_vectors.  It addresses the memory corruption by leaving the
rings in place and instead just copying the contents of the new rings into
the existing rings.

Signed-off-by: default avatarAlexander Duyck <alexander.h.duyck@intel.com>
Acked-by: default avatarGreg Rose <gregory.v.rose@intel.com>
Tested-by: default avatarSibai Li <sibai.li@intel.com>
Signed-off-by: default avatarJeff Kirsher <jeffrey.t.kirsher@intel.com>
parent 70a10e25

drivers/net/ethernet/intel/ixgbevf/ethtool.c

+83 −70
Original line number Diff line number Diff line
@@ -284,13 +284,11 @@ static void ixgbevf_get_ringparam(struct net_device *netdev, 
				  struct ethtool_ringparam *ring)

{

	struct ixgbevf_adapter *adapter = netdev_priv(netdev);

	struct ixgbevf_ring *tx_ring = adapter->tx_ring;

	struct ixgbevf_ring *rx_ring = adapter->rx_ring;



	ring->rx_max_pending = IXGBEVF_MAX_RXD;

	ring->tx_max_pending = IXGBEVF_MAX_TXD;

	ring->rx_pending = rx_ring->count;

	ring->tx_pending = tx_ring->count;

	ring->rx_pending = adapter->rx_ring_count;

	ring->tx_pending = adapter->tx_ring_count;

}



static int ixgbevf_set_ringparam(struct net_device *netdev,
@@ -298,33 +296,28 @@ static int ixgbevf_set_ringparam(struct net_device *netdev, 
{

	struct ixgbevf_adapter *adapter = netdev_priv(netdev);

	struct ixgbevf_ring *tx_ring = NULL, *rx_ring = NULL;

	int i, err = 0;

	u32 new_rx_count, new_tx_count;

	int i, err = 0;



	if ((ring->rx_mini_pending) || (ring->rx_jumbo_pending))

		return -EINVAL;



	new_rx_count = max(ring->rx_pending, (u32)IXGBEVF_MIN_RXD);

	new_rx_count = min(new_rx_count, (u32)IXGBEVF_MAX_RXD);

	new_rx_count = ALIGN(new_rx_count, IXGBE_REQ_RX_DESCRIPTOR_MULTIPLE);



	new_tx_count = max(ring->tx_pending, (u32)IXGBEVF_MIN_TXD);

	new_tx_count = min(new_tx_count, (u32)IXGBEVF_MAX_TXD);

	new_tx_count = max_t(u32, ring->tx_pending, IXGBEVF_MIN_TXD);

	new_tx_count = min_t(u32, new_tx_count, IXGBEVF_MAX_TXD);

	new_tx_count = ALIGN(new_tx_count, IXGBE_REQ_TX_DESCRIPTOR_MULTIPLE);



	if ((new_tx_count == adapter->tx_ring->count) &&

	    (new_rx_count == adapter->rx_ring->count)) {

		/* nothing to do */

	new_rx_count = max_t(u32, ring->rx_pending, IXGBEVF_MIN_RXD);

	new_rx_count = min_t(u32, new_rx_count, IXGBEVF_MAX_RXD);

	new_rx_count = ALIGN(new_rx_count, IXGBE_REQ_RX_DESCRIPTOR_MULTIPLE);



	/* if nothing to do return success */

	if ((new_tx_count == adapter->tx_ring_count) &&

	    (new_rx_count == adapter->rx_ring_count))

		return 0;

	}



	while (test_and_set_bit(__IXGBEVF_RESETTING, &adapter->state))

		msleep(1);

		usleep_range(1000, 2000);



	/*

	 * If the adapter isn't up and running then just set the

	 * new parameters and scurry for the exits.

	 */

	if (!netif_running(adapter->netdev)) {

		for (i = 0; i < adapter->num_tx_queues; i++)

			adapter->tx_ring[i].count = new_tx_count;
@@ -335,78 +328,98 @@ static int ixgbevf_set_ringparam(struct net_device *netdev, 
		goto clear_reset;

	}



	tx_ring = kcalloc(adapter->num_tx_queues,

			  sizeof(struct ixgbevf_ring), GFP_KERNEL);

	if (new_tx_count != adapter->tx_ring_count) {

		tx_ring = vmalloc(adapter->num_tx_queues * sizeof(*tx_ring));

		if (!tx_ring) {

			err = -ENOMEM;

			goto clear_reset;

		}



	rx_ring = kcalloc(adapter->num_rx_queues,

			  sizeof(struct ixgbevf_ring), GFP_KERNEL);

	if (!rx_ring) {

		err = -ENOMEM;

		goto err_rx_setup;

	}



	ixgbevf_down(adapter);



	memcpy(tx_ring, adapter->tx_ring,

	       adapter->num_tx_queues * sizeof(struct ixgbevf_ring));

		for (i = 0; i < adapter->num_tx_queues; i++) {

			/* clone ring and setup updated count */

			tx_ring[i] = adapter->tx_ring[i];

			tx_ring[i].count = new_tx_count;

			err = ixgbevf_setup_tx_resources(adapter, &tx_ring[i]);

		if (err) {

			if (!err)

				continue;

			while (i) {

				i--;

				ixgbevf_free_tx_resources(adapter, &tx_ring[i]);

			}

			goto err_tx_ring_setup;



			vfree(tx_ring);

			tx_ring = NULL;



			goto clear_reset;

		}

	}



	memcpy(rx_ring, adapter->rx_ring,

	       adapter->num_rx_queues * sizeof(struct ixgbevf_ring));

	if (new_rx_count != adapter->rx_ring_count) {

		rx_ring = vmalloc(adapter->num_rx_queues * sizeof(*rx_ring));

		if (!rx_ring) {

			err = -ENOMEM;

			goto clear_reset;

		}



		for (i = 0; i < adapter->num_rx_queues; i++) {

			/* clone ring and setup updated count */

			rx_ring[i] = adapter->rx_ring[i];

			rx_ring[i].count = new_rx_count;

			err = ixgbevf_setup_rx_resources(adapter, &rx_ring[i]);

		if (err) {

			if (!err)

				continue;

			while (i) {

				i--;

				ixgbevf_free_rx_resources(adapter, &rx_ring[i]);

			}

				goto err_rx_ring_setup;



			vfree(rx_ring);

			rx_ring = NULL;



			goto clear_reset;

		}

	}



	/*

	 * Only switch to new rings if all the prior allocations

	 * and ring setups have succeeded.

	 */

	kfree(adapter->tx_ring);

	adapter->tx_ring = tx_ring;

	/* bring interface down to prepare for update */

	ixgbevf_down(adapter);



	/* Tx */

	if (tx_ring) {

		for (i = 0; i < adapter->num_tx_queues; i++) {

			ixgbevf_free_tx_resources(adapter,

						  &adapter->tx_ring[i]);

			adapter->tx_ring[i] = tx_ring[i];

		}

		adapter->tx_ring_count = new_tx_count;



	kfree(adapter->rx_ring);

	adapter->rx_ring = rx_ring;

		vfree(tx_ring);

		tx_ring = NULL;

	}



	/* Rx */

	if (rx_ring) {

		for (i = 0; i < adapter->num_rx_queues; i++) {

			ixgbevf_free_rx_resources(adapter,

						  &adapter->rx_ring[i]);

			adapter->rx_ring[i] = rx_ring[i];

		}

		adapter->rx_ring_count = new_rx_count;



	/* success! */

	ixgbevf_up(adapter);

		vfree(rx_ring);

		rx_ring = NULL;

	}



	goto clear_reset;

	/* restore interface using new values */

	ixgbevf_up(adapter);



err_rx_ring_setup:

clear_reset:

	/* free Tx resources if Rx error is encountered */

	if (tx_ring) {

		for (i = 0; i < adapter->num_tx_queues; i++)

			ixgbevf_free_tx_resources(adapter, &tx_ring[i]);

		vfree(tx_ring);

	}



err_tx_ring_setup:

	kfree(rx_ring);



err_rx_setup:

	kfree(tx_ring);



clear_reset:

	clear_bit(__IXGBEVF_RESETTING, &adapter->state);

	return err;

}