Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5e3b1ff9 authored by Ciara Loftus's avatar Ciara Loftus Committed by Greg Kroah-Hartman
Browse files

i40e: protect ring accesses with READ- and WRITE_ONCE 



[ Upstream commit d59e267912cd90b0adf33b4659050d831e746317 ]

READ_ONCE should be used when reading rings prior to accessing the
statistics pointer. Introduce this as well as the corresponding WRITE_ONCE
usage when allocating and freeing the rings, to ensure protected access.

Signed-off-by: default avatarCiara Loftus <ciara.loftus@intel.com>
Tested-by: default avatarAndrew Bowers <andrewx.bowers@intel.com>
Signed-off-by: default avatarJeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent e421eb90

drivers/net/ethernet/intel/i40e/i40e_main.c

+19 −10
Original line number Diff line number Diff line
@@ -446,11 +446,15 @@ static void i40e_get_netdev_stats_struct(struct net_device *netdev, 
		i40e_get_netdev_stats_struct_tx(ring, stats);



		if (i40e_enabled_xdp_vsi(vsi)) {

			ring++;

			ring = READ_ONCE(vsi->xdp_rings[i]);

			if (!ring)

				continue;

			i40e_get_netdev_stats_struct_tx(ring, stats);

		}



		ring++;

		ring = READ_ONCE(vsi->rx_rings[i]);

		if (!ring)

			continue;

		do {

			start   = u64_stats_fetch_begin_irq(&ring->syncp);

			packets = ring->stats.packets;
@@ -793,6 +797,8 @@ static void i40e_update_vsi_stats(struct i40e_vsi *vsi) 
	for (q = 0; q < vsi->num_queue_pairs; q++) {

		/* locate Tx ring */

		p = READ_ONCE(vsi->tx_rings[q]);

		if (!p)

			continue;



		do {

			start = u64_stats_fetch_begin_irq(&p->syncp);
@@ -806,8 +812,11 @@ static void i40e_update_vsi_stats(struct i40e_vsi *vsi) 
		tx_linearize += p->tx_stats.tx_linearize;

		tx_force_wb += p->tx_stats.tx_force_wb;



		/* Rx queue is part of the same block as Tx queue */

		p = &p[1];

		/* locate Rx ring */

		p = READ_ONCE(vsi->rx_rings[q]);

		if (!p)

			continue;



		do {

			start = u64_stats_fetch_begin_irq(&p->syncp);

			packets = p->stats.packets;
@@ -10196,10 +10205,10 @@ static void i40e_vsi_clear_rings(struct i40e_vsi *vsi) 
	if (vsi->tx_rings && vsi->tx_rings[0]) {

		for (i = 0; i < vsi->alloc_queue_pairs; i++) {

			kfree_rcu(vsi->tx_rings[i], rcu);

			vsi->tx_rings[i] = NULL;

			vsi->rx_rings[i] = NULL;

			WRITE_ONCE(vsi->tx_rings[i], NULL);

			WRITE_ONCE(vsi->rx_rings[i], NULL);

			if (vsi->xdp_rings)

				vsi->xdp_rings[i] = NULL;

				WRITE_ONCE(vsi->xdp_rings[i], NULL);

		}

	}

}
@@ -10233,7 +10242,7 @@ static int i40e_alloc_rings(struct i40e_vsi *vsi) 
		if (vsi->back->hw_features & I40E_HW_WB_ON_ITR_CAPABLE)

			ring->flags = I40E_TXR_FLAGS_WB_ON_ITR;

		ring->itr_setting = pf->tx_itr_default;

		vsi->tx_rings[i] = ring++;

		WRITE_ONCE(vsi->tx_rings[i], ring++);



		if (!i40e_enabled_xdp_vsi(vsi))

			goto setup_rx;
@@ -10251,7 +10260,7 @@ static int i40e_alloc_rings(struct i40e_vsi *vsi) 
			ring->flags = I40E_TXR_FLAGS_WB_ON_ITR;

		set_ring_xdp(ring);

		ring->itr_setting = pf->tx_itr_default;

		vsi->xdp_rings[i] = ring++;

		WRITE_ONCE(vsi->xdp_rings[i], ring++);



setup_rx:

		ring->queue_index = i;
@@ -10264,7 +10273,7 @@ static int i40e_alloc_rings(struct i40e_vsi *vsi) 
		ring->size = 0;

		ring->dcb_tc = 0;

		ring->itr_setting = pf->rx_itr_default;

		vsi->rx_rings[i] = ring;

		WRITE_ONCE(vsi->rx_rings[i], ring);

	}



	return 0;