ixgbevf: Fix multiple issues in ixgbevf_get/set_ringparam

In ixgbevf_get_ringparam we could run into a NULL pointer dereference
if the rings were not allocated when we attempted the call.  To prevent
that we can just access the tx/rx_ring_count values instead of attempting
to access the rings to get the count.

This change corrects a memory leak and memory corruption in
ixgbevf_set_ringparam.

The memory leak was due to us not freeing the resources from the ring
before overwriting them.  This change corrects the memory leak by making
certain to call ixgbe_free_tx/rx_resources on the rings prior to freeing
them.

The memory corruption was because we were replacing the rings but not
updating the q_vectors.  It addresses the memory corruption by leaving the
rings in place and instead just copying the contents of the new rings into
the existing rings.

Signed-off-by: Alexander Duyck <alexander.h.duyck@intel.com>
Acked-by: Greg Rose <gregory.v.rose@intel.com>
Tested-by: Sibai Li <sibai.li@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>

diff --git a/drivers/net/ethernet/intel/ixgbevf/ethtool.c b/drivers/net/ethernet/intel/ixgbevf/ethtool.c
index 2c3b20edd84d9ba578f4705e9026cdd8d28ae816..8f2070439b5966fdc515eef68f07ebbda4ef1bba 100644 (file)
--- a/drivers/net/ethernet/intel/ixgbevf/ethtool.c
+++ b/drivers/net/ethernet/intel/ixgbevf/ethtool.c
@@ -284,13 +284,11 @@ static void ixgbevf_get_ringparam(struct net_device *netdev,
                                  struct ethtool_ringparam *ring)
 {
        struct ixgbevf_adapter *adapter = netdev_priv(netdev);
-       struct ixgbevf_ring *tx_ring = adapter->tx_ring;
-       struct ixgbevf_ring *rx_ring = adapter->rx_ring;
 
        ring->rx_max_pending = IXGBEVF_MAX_RXD;
        ring->tx_max_pending = IXGBEVF_MAX_TXD;
-       ring->rx_pending = rx_ring->count;
-       ring->tx_pending = tx_ring->count;
+       ring->rx_pending = adapter->rx_ring_count;
+       ring->tx_pending = adapter->tx_ring_count;
 }
 
 static int ixgbevf_set_ringparam(struct net_device *netdev,
@@ -298,33 +296,28 @@ static int ixgbevf_set_ringparam(struct net_device *netdev,
 {
        struct ixgbevf_adapter *adapter = netdev_priv(netdev);
        struct ixgbevf_ring *tx_ring = NULL, *rx_ring = NULL;
-       int i, err = 0;
        u32 new_rx_count, new_tx_count;
+       int i, err = 0;
 
        if ((ring->rx_mini_pending) || (ring->rx_jumbo_pending))
                return -EINVAL;
 
-       new_rx_count = max(ring->rx_pending, (u32)IXGBEVF_MIN_RXD);
-       new_rx_count = min(new_rx_count, (u32)IXGBEVF_MAX_RXD);
-       new_rx_count = ALIGN(new_rx_count, IXGBE_REQ_RX_DESCRIPTOR_MULTIPLE);
-
-       new_tx_count = max(ring->tx_pending, (u32)IXGBEVF_MIN_TXD);
-       new_tx_count = min(new_tx_count, (u32)IXGBEVF_MAX_TXD);
+       new_tx_count = max_t(u32, ring->tx_pending, IXGBEVF_MIN_TXD);
+       new_tx_count = min_t(u32, new_tx_count, IXGBEVF_MAX_TXD);
        new_tx_count = ALIGN(new_tx_count, IXGBE_REQ_TX_DESCRIPTOR_MULTIPLE);
 
-       if ((new_tx_count == adapter->tx_ring->count) &&
-           (new_rx_count == adapter->rx_ring->count)) {
-               /* nothing to do */
+       new_rx_count = max_t(u32, ring->rx_pending, IXGBEVF_MIN_RXD);
+       new_rx_count = min_t(u32, new_rx_count, IXGBEVF_MAX_RXD);
+       new_rx_count = ALIGN(new_rx_count, IXGBE_REQ_RX_DESCRIPTOR_MULTIPLE);
+
+       /* if nothing to do return success */
+       if ((new_tx_count == adapter->tx_ring_count) &&
+           (new_rx_count == adapter->rx_ring_count))
                return 0;
-       }
 
        while (test_and_set_bit(__IXGBEVF_RESETTING, &adapter->state))
-               msleep(1);
+               usleep_range(1000, 2000);
 
-       /*
-        * If the adapter isn't up and running then just set the
-        * new parameters and scurry for the exits.
-        */
        if (!netif_running(adapter->netdev)) {
                for (i = 0; i < adapter->num_tx_queues; i++)
                        adapter->tx_ring[i].count = new_tx_count;
@@ -335,78 +328,98 @@ static int ixgbevf_set_ringparam(struct net_device *netdev,
                goto clear_reset;
        }
 
-       tx_ring = kcalloc(adapter->num_tx_queues,
-                         sizeof(struct ixgbevf_ring), GFP_KERNEL);
-       if (!tx_ring) {
-               err = -ENOMEM;
-               goto clear_reset;
-       }
-
-       rx_ring = kcalloc(adapter->num_rx_queues,
-                         sizeof(struct ixgbevf_ring), GFP_KERNEL);
-       if (!rx_ring) {
-               err = -ENOMEM;
-               goto err_rx_setup;
-       }
-
-       ixgbevf_down(adapter);
+       if (new_tx_count != adapter->tx_ring_count) {
+               tx_ring = vmalloc(adapter->num_tx_queues * sizeof(*tx_ring));
+               if (!tx_ring) {
+                       err = -ENOMEM;
+                       goto clear_reset;
+               }
 
-       memcpy(tx_ring, adapter->tx_ring,
-              adapter->num_tx_queues * sizeof(struct ixgbevf_ring));
-       for (i = 0; i < adapter->num_tx_queues; i++) {
-               tx_ring[i].count = new_tx_count;
-               err = ixgbevf_setup_tx_resources(adapter, &tx_ring[i]);
-               if (err) {
+               for (i = 0; i < adapter->num_tx_queues; i++) {
+                       /* clone ring and setup updated count */
+                       tx_ring[i] = adapter->tx_ring[i];
+                       tx_ring[i].count = new_tx_count;
+                       err = ixgbevf_setup_tx_resources(adapter, &tx_ring[i]);
+                       if (!err)
+                               continue;
                        while (i) {
                                i--;
                                ixgbevf_free_tx_resources(adapter, &tx_ring[i]);
                        }
-                       goto err_tx_ring_setup;
+
+                       vfree(tx_ring);
+                       tx_ring = NULL;
+
+                       goto clear_reset;
                }
        }
 
-       memcpy(rx_ring, adapter->rx_ring,
-              adapter->num_rx_queues * sizeof(struct ixgbevf_ring));
-       for (i = 0; i < adapter->num_rx_queues; i++) {
-               rx_ring[i].count = new_rx_count;
-               err = ixgbevf_setup_rx_resources(adapter, &rx_ring[i]);
-               if (err) {
+       if (new_rx_count != adapter->rx_ring_count) {
+               rx_ring = vmalloc(adapter->num_rx_queues * sizeof(*rx_ring));
+               if (!rx_ring) {
+                       err = -ENOMEM;
+                       goto clear_reset;
+               }
+
+               for (i = 0; i < adapter->num_rx_queues; i++) {
+                       /* clone ring and setup updated count */
+                       rx_ring[i] = adapter->rx_ring[i];
+                       rx_ring[i].count = new_rx_count;
+                       err = ixgbevf_setup_rx_resources(adapter, &rx_ring[i]);
+                       if (!err)
+                               continue;
                        while (i) {
                                i--;
                                ixgbevf_free_rx_resources(adapter, &rx_ring[i]);
                        }
-                               goto err_rx_ring_setup;
+
+                       vfree(rx_ring);
+                       rx_ring = NULL;
+
+                       goto clear_reset;
                }
        }
 
-       /*
-        * Only switch to new rings if all the prior allocations
-        * and ring setups have succeeded.
-        */
-       kfree(adapter->tx_ring);
-       adapter->tx_ring = tx_ring;
-       adapter->tx_ring_count = new_tx_count;
-
-       kfree(adapter->rx_ring);
-       adapter->rx_ring = rx_ring;
-       adapter->rx_ring_count = new_rx_count;
+       /* bring interface down to prepare for update */
+       ixgbevf_down(adapter);
 
-       /* success! */
-       ixgbevf_up(adapter);
+       /* Tx */
+       if (tx_ring) {
+               for (i = 0; i < adapter->num_tx_queues; i++) {
+                       ixgbevf_free_tx_resources(adapter,
+                                                 &adapter->tx_ring[i]);
+                       adapter->tx_ring[i] = tx_ring[i];
+               }
+               adapter->tx_ring_count = new_tx_count;
 
-       goto clear_reset;
+               vfree(tx_ring);
+               tx_ring = NULL;
+       }
 
-err_rx_ring_setup:
-       for(i = 0; i < adapter->num_tx_queues; i++)
-               ixgbevf_free_tx_resources(adapter, &tx_ring[i]);
+       /* Rx */
+       if (rx_ring) {
+               for (i = 0; i < adapter->num_rx_queues; i++) {
+                       ixgbevf_free_rx_resources(adapter,
+                                                 &adapter->rx_ring[i]);
+                       adapter->rx_ring[i] = rx_ring[i];
+               }
+               adapter->rx_ring_count = new_rx_count;
 
-err_tx_ring_setup:
-       kfree(rx_ring);
+               vfree(rx_ring);
+               rx_ring = NULL;
+       }
 
-err_rx_setup:
-       kfree(tx_ring);
+       /* restore interface using new values */
+       ixgbevf_up(adapter);
 
 clear_reset:
+       /* free Tx resources if Rx error is encountered */
+       if (tx_ring) {
+               for (i = 0; i < adapter->num_tx_queues; i++)
+                       ixgbevf_free_tx_resources(adapter, &tx_ring[i]);
+               vfree(tx_ring);
+       }
+
        clear_bit(__IXGBEVF_RESETTING, &adapter->state);
        return err;
 }