From eb022d058f5ad48c45f1f31c36865d2c676aedc9 Mon Sep 17 00:00:00 2001 From: Alexander Duyck Date: Thu, 19 Jul 2012 00:18:05 +0000 Subject: [PATCH] ixgbevf: Fix multiple issues in ixgbevf_get/set_ringparam In ixgbevf_get_ringparam we could run into a NULL pointer dereference if the rings were not allocated when we attempted the call. To prevent that we can just access the tx/rx_ring_count values instead of attempting to access the rings to get the count. This change corrects a memory leak and memory corruption in ixgbevf_set_ringparam. The memory leak was due to us not freeing the resources from the ring before overwriting them. This change corrects the memory leak by making certain to call ixgbe_free_tx/rx_resources on the rings prior to freeing them. The memory corruption was because we were replacing the rings but not updating the q_vectors. It addresses the memory corruption by leaving the rings in place and instead just copying the contents of the new rings into the existing rings. Signed-off-by: Alexander Duyck Acked-by: Greg Rose Tested-by: Sibai Li Signed-off-by: Jeff Kirsher --- drivers/net/ethernet/intel/ixgbevf/ethtool.c | 153 ++++++++++--------- 1 file changed, 83 insertions(+), 70 deletions(-) diff --git a/drivers/net/ethernet/intel/ixgbevf/ethtool.c b/drivers/net/ethernet/intel/ixgbevf/ethtool.c index 2c3b20edd84d..8f2070439b59 100644 --- a/drivers/net/ethernet/intel/ixgbevf/ethtool.c +++ b/drivers/net/ethernet/intel/ixgbevf/ethtool.c @@ -284,13 +284,11 @@ static void ixgbevf_get_ringparam(struct net_device *netdev, struct ethtool_ringparam *ring) { struct ixgbevf_adapter *adapter = netdev_priv(netdev); - struct ixgbevf_ring *tx_ring = adapter->tx_ring; - struct ixgbevf_ring *rx_ring = adapter->rx_ring; ring->rx_max_pending = IXGBEVF_MAX_RXD; ring->tx_max_pending = IXGBEVF_MAX_TXD; - ring->rx_pending = rx_ring->count; - ring->tx_pending = tx_ring->count; + ring->rx_pending = adapter->rx_ring_count; + ring->tx_pending = adapter->tx_ring_count; } static int ixgbevf_set_ringparam(struct net_device *netdev, @@ -298,33 +296,28 @@ static int ixgbevf_set_ringparam(struct net_device *netdev, { struct ixgbevf_adapter *adapter = netdev_priv(netdev); struct ixgbevf_ring *tx_ring = NULL, *rx_ring = NULL; - int i, err = 0; u32 new_rx_count, new_tx_count; + int i, err = 0; if ((ring->rx_mini_pending) || (ring->rx_jumbo_pending)) return -EINVAL; - new_rx_count = max(ring->rx_pending, (u32)IXGBEVF_MIN_RXD); - new_rx_count = min(new_rx_count, (u32)IXGBEVF_MAX_RXD); - new_rx_count = ALIGN(new_rx_count, IXGBE_REQ_RX_DESCRIPTOR_MULTIPLE); - - new_tx_count = max(ring->tx_pending, (u32)IXGBEVF_MIN_TXD); - new_tx_count = min(new_tx_count, (u32)IXGBEVF_MAX_TXD); + new_tx_count = max_t(u32, ring->tx_pending, IXGBEVF_MIN_TXD); + new_tx_count = min_t(u32, new_tx_count, IXGBEVF_MAX_TXD); new_tx_count = ALIGN(new_tx_count, IXGBE_REQ_TX_DESCRIPTOR_MULTIPLE); - if ((new_tx_count == adapter->tx_ring->count) && - (new_rx_count == adapter->rx_ring->count)) { - /* nothing to do */ + new_rx_count = max_t(u32, ring->rx_pending, IXGBEVF_MIN_RXD); + new_rx_count = min_t(u32, new_rx_count, IXGBEVF_MAX_RXD); + new_rx_count = ALIGN(new_rx_count, IXGBE_REQ_RX_DESCRIPTOR_MULTIPLE); + + /* if nothing to do return success */ + if ((new_tx_count == adapter->tx_ring_count) && + (new_rx_count == adapter->rx_ring_count)) return 0; - } while (test_and_set_bit(__IXGBEVF_RESETTING, &adapter->state)) - msleep(1); + usleep_range(1000, 2000); - /* - * If the adapter isn't up and running then just set the - * new parameters and scurry for the exits. - */ if (!netif_running(adapter->netdev)) { for (i = 0; i < adapter->num_tx_queues; i++) adapter->tx_ring[i].count = new_tx_count; @@ -335,78 +328,98 @@ static int ixgbevf_set_ringparam(struct net_device *netdev, goto clear_reset; } - tx_ring = kcalloc(adapter->num_tx_queues, - sizeof(struct ixgbevf_ring), GFP_KERNEL); - if (!tx_ring) { - err = -ENOMEM; - goto clear_reset; - } - - rx_ring = kcalloc(adapter->num_rx_queues, - sizeof(struct ixgbevf_ring), GFP_KERNEL); - if (!rx_ring) { - err = -ENOMEM; - goto err_rx_setup; - } - - ixgbevf_down(adapter); + if (new_tx_count != adapter->tx_ring_count) { + tx_ring = vmalloc(adapter->num_tx_queues * sizeof(*tx_ring)); + if (!tx_ring) { + err = -ENOMEM; + goto clear_reset; + } - memcpy(tx_ring, adapter->tx_ring, - adapter->num_tx_queues * sizeof(struct ixgbevf_ring)); - for (i = 0; i < adapter->num_tx_queues; i++) { - tx_ring[i].count = new_tx_count; - err = ixgbevf_setup_tx_resources(adapter, &tx_ring[i]); - if (err) { + for (i = 0; i < adapter->num_tx_queues; i++) { + /* clone ring and setup updated count */ + tx_ring[i] = adapter->tx_ring[i]; + tx_ring[i].count = new_tx_count; + err = ixgbevf_setup_tx_resources(adapter, &tx_ring[i]); + if (!err) + continue; while (i) { i--; ixgbevf_free_tx_resources(adapter, &tx_ring[i]); } - goto err_tx_ring_setup; + + vfree(tx_ring); + tx_ring = NULL; + + goto clear_reset; } } - memcpy(rx_ring, adapter->rx_ring, - adapter->num_rx_queues * sizeof(struct ixgbevf_ring)); - for (i = 0; i < adapter->num_rx_queues; i++) { - rx_ring[i].count = new_rx_count; - err = ixgbevf_setup_rx_resources(adapter, &rx_ring[i]); - if (err) { + if (new_rx_count != adapter->rx_ring_count) { + rx_ring = vmalloc(adapter->num_rx_queues * sizeof(*rx_ring)); + if (!rx_ring) { + err = -ENOMEM; + goto clear_reset; + } + + for (i = 0; i < adapter->num_rx_queues; i++) { + /* clone ring and setup updated count */ + rx_ring[i] = adapter->rx_ring[i]; + rx_ring[i].count = new_rx_count; + err = ixgbevf_setup_rx_resources(adapter, &rx_ring[i]); + if (!err) + continue; while (i) { i--; ixgbevf_free_rx_resources(adapter, &rx_ring[i]); } - goto err_rx_ring_setup; + + vfree(rx_ring); + rx_ring = NULL; + + goto clear_reset; } } - /* - * Only switch to new rings if all the prior allocations - * and ring setups have succeeded. - */ - kfree(adapter->tx_ring); - adapter->tx_ring = tx_ring; - adapter->tx_ring_count = new_tx_count; - - kfree(adapter->rx_ring); - adapter->rx_ring = rx_ring; - adapter->rx_ring_count = new_rx_count; + /* bring interface down to prepare for update */ + ixgbevf_down(adapter); - /* success! */ - ixgbevf_up(adapter); + /* Tx */ + if (tx_ring) { + for (i = 0; i < adapter->num_tx_queues; i++) { + ixgbevf_free_tx_resources(adapter, + &adapter->tx_ring[i]); + adapter->tx_ring[i] = tx_ring[i]; + } + adapter->tx_ring_count = new_tx_count; - goto clear_reset; + vfree(tx_ring); + tx_ring = NULL; + } -err_rx_ring_setup: - for(i = 0; i < adapter->num_tx_queues; i++) - ixgbevf_free_tx_resources(adapter, &tx_ring[i]); + /* Rx */ + if (rx_ring) { + for (i = 0; i < adapter->num_rx_queues; i++) { + ixgbevf_free_rx_resources(adapter, + &adapter->rx_ring[i]); + adapter->rx_ring[i] = rx_ring[i]; + } + adapter->rx_ring_count = new_rx_count; -err_tx_ring_setup: - kfree(rx_ring); + vfree(rx_ring); + rx_ring = NULL; + } -err_rx_setup: - kfree(tx_ring); + /* restore interface using new values */ + ixgbevf_up(adapter); clear_reset: + /* free Tx resources if Rx error is encountered */ + if (tx_ring) { + for (i = 0; i < adapter->num_tx_queues; i++) + ixgbevf_free_tx_resources(adapter, &tx_ring[i]); + vfree(tx_ring); + } + clear_bit(__IXGBEVF_RESETTING, &adapter->state); return err; } -- 2.30.2