| Message ID | 20231012101706.2291551-1-srasheed@marvell.com (mailing list archive) |
|---|---|
| State | Superseded |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net,v2] octeon_ep: update BQL sent bytes before ringing doorbell | expand |
On Thu, 12 Oct 2023 03:17:06 -0700 Shinas Rasheed wrote: > Sometimes Tx is completed immediately after doorbell is updated, which > causes Tx completion routing to update completion bytes before the > same packet bytes are updated in sent bytes in transmit function, hence > hitting BUG_ON() in dql_completed(). To avoid this, update BQL > sent bytes before ringing doorbell. Please read this: https://www.kernel.org/doc/html/next/process/maintainer-netdev.html#resending-after-review And also when you reply to people please use sane quoting. This: >>> is used to indicate three levels of quoting.
Hi Jakub, Apologizing for the format errors on my part. Should I send the v2 patch again separately in a new thread, or will this be enough for now to avoid the clutter?
On Fri, 13 Oct 2023 09:04:07 +0000 Shinas Rasheed wrote: > Apologizing for the format errors on my part. Should I send the v2 > patch again separately in a new thread, or will this be enough for > now to avoid the clutter? Sorry, I meant to get to this on Friday but run out of hours. No need to repost, my comments were just for future reference since you have sent multiple patches already and will likely send more :)
On Thu, 12 Oct 2023 03:17:06 -0700 Shinas Rasheed wrote: > - netdev_tx_sent_queue(iq->netdev_q, skb->len); > iq->stats.instr_posted++; > skb_tx_timestamp(skb); The skb_tx_timestamp() here will do the same exact UAF, no? I think you should move them both.
diff --git a/drivers/net/ethernet/marvell/octeon_ep/octep_main.c b/drivers/net/ethernet/marvell/octeon_ep/octep_main.c index dbc518ff8276..15420325aef3 100644 --- a/drivers/net/ethernet/marvell/octeon_ep/octep_main.c +++ b/drivers/net/ethernet/marvell/octeon_ep/octep_main.c @@ -715,6 +715,7 @@ static netdev_tx_t octep_start_xmit(struct sk_buff *skb, hw_desc->dptr = tx_buffer->sglist_dma; } + netdev_tx_sent_queue(iq->netdev_q, skb->len); /* Flush the hw descriptor before writing to doorbell */ wmb(); @@ -726,7 +727,6 @@ static netdev_tx_t octep_start_xmit(struct sk_buff *skb, wi = 0; iq->host_write_index = wi; - netdev_tx_sent_queue(iq->netdev_q, skb->len); iq->stats.instr_posted++; skb_tx_timestamp(skb); return NETDEV_TX_OK;
Sometimes Tx is completed immediately after doorbell is updated, which causes Tx completion routing to update completion bytes before the same packet bytes are updated in sent bytes in transmit function, hence hitting BUG_ON() in dql_completed(). To avoid this, update BQL sent bytes before ringing doorbell. Fixes: 37d79d059606 ("octeon_ep: add Tx/Rx processing and interrupt support") Signed-off-by: Shinas Rasheed <srasheed@marvell.com> --- V1 -> V2: Call netdev_tx_sent_queue before memory barrier drivers/net/ethernet/marvell/octeon_ep/octep_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)