From patchwork Tue Feb 13 05:35:31 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jakub Kicinski X-Patchwork-Id: 872615 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=netronome-com.20150623.gappssmtp.com header.i=@netronome-com.20150623.gappssmtp.com header.b="gYu56IRx"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3zgWVb4YfFz9s7h for ; Tue, 13 Feb 2018 16:36:23 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751721AbeBMFgJ (ORCPT ); Tue, 13 Feb 2018 00:36:09 -0500 Received: from mail-pl0-f68.google.com ([209.85.160.68]:44511 "EHLO mail-pl0-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751685AbeBMFgI (ORCPT ); Tue, 13 Feb 2018 00:36:08 -0500 Received: by mail-pl0-f68.google.com with SMTP id f8so6130350plk.11 for ; Mon, 12 Feb 2018 21:36:08 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=netronome-com.20150623.gappssmtp.com; s=20150623; h=from:to:cc:subject:date:message-id; bh=QXtWxMsJ+5VRsyMUrKS4VgvLADTX5/brnbU1A6DJ0Mk=; b=gYu56IRxWLrKpn7f4s3zj9+GCGtdZAlG1CsucTjn2UOgG9SFPmGZ64gkMGFhSakmDJ sitySHj/tO7pQ1Aor61c7YW4dwnj1OHrrqupCqNV9rXyUDzTQR5i0iOaGRihfjt0nSWY 283Yed7fUHKPlxhP3IUDh/gU3ymXaiZveNHZ+32fyq2gC7BG+8Bi9uAYFxtIEPWp0Bia OX1FUt55fjvJS9BK98BvlzNmwmeLa5i4NgjlUqSBWuDijGu3qAHHQjFXNV/l2bWvK8Dk LRa+F/xnKBYugCTklWb0D9vgtAM1dp3mdr5FBEQw9R1kiCHhWXML2vuAIDfZsJUmH6C9 AEng== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=QXtWxMsJ+5VRsyMUrKS4VgvLADTX5/brnbU1A6DJ0Mk=; b=BGYf7yClqedICDykz9Zg8yNjXfO48DKBNcytHBVCB8FkSvX6Z2bYWyCFqWFKIq9QdK AXe9gNK6kK25KQbzVmp0ZjzJAT9Lpx3TE+XgY1+xt6YvqhmkUqtT5Jp816dHlgq7SZeP o06nPM134xuelAPieZHpSE5m9GxIcp6Qf46Kq9ANf6JCfWQLLSfg8FR+rrI0w/wboMsX Vhdo+VuowW1iHtg/mEahcei8fnKsWlY+DUEaRbAWxH1JsUA6iRt9ZAUOYkoDnlrJc9WB CCjULR7LFDn89MC9B2I0jzZTro5Gk4iUEZFk2Cl9fSTAlZmnf7kJkySBlsbthASHhrhC RuNA== X-Gm-Message-State: APf1xPDKc5Laxr+m+2xkeNvKGdP08HfJEp3q4c2Lg5KB8wj8AZE2I+Cz SxieMBUxLkBw2xJ2wJgpeL4sNA== X-Google-Smtp-Source: AH8x227w13vEFJnIsCIETqEmBHxeDFT+TelzAPcJCZ721QjkqVxvvPxOgDqLnvfANuCNA27S/STAHA== X-Received: by 2002:a17:902:3124:: with SMTP id w33-v6mr46277plb.356.1518500168330; Mon, 12 Feb 2018 21:36:08 -0800 (PST) Received: from jkicinski-Precision-T1700.netronome.com ([75.53.12.129]) by smtp.gmail.com with ESMTPSA id a84sm31647028pfc.116.2018.02.12.21.36.07 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 12 Feb 2018 21:36:07 -0800 (PST) From: Jakub Kicinski To: davem@davemloft.net Cc: john.fastabend@gmail.com, alexander.duyck@gmail.com, tom@herbertland.com, netdev@vger.kernel.org, oss-drivers@netronome.com, Jakub Kicinski Subject: [PATCH net] net: fix race on decreasing number of TX queues Date: Mon, 12 Feb 2018 21:35:31 -0800 Message-Id: <20180213053531.13080-1-jakub.kicinski@netronome.com> X-Mailer: git-send-email 2.15.1 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org netif_set_real_num_tx_queues() can be called when netdev is up. That usually happens when user requests change of number of channels/rings with ethtool -L. The procedure for changing the number of queues involves resetting the qdiscs and setting dev->num_tx_queues to the new value. When the new value is lower than the old one, extra care has to be taken to ensure ordering of accesses to the number of queues vs qdisc reset. Currently the queues are reset before new dev->num_tx_queues is assigned, leaving a window of time where packets can be enqueued onto the queues going down, leading to a likely crash in the drivers, since most drivers don't check if TX skbs are assigned to an active queue. Fixes: e6484930d7c7 ("net: allocate tx queues in register_netdevice") Signed-off-by: Jakub Kicinski --- Also reported: http://lists.openwall.net/netdev/2017/04/26/211, GSO just made it more likely. --- net/core/dev.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/net/core/dev.c b/net/core/dev.c index dda9d7b9a840..d4362befe7e2 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -2382,8 +2382,11 @@ EXPORT_SYMBOL(netdev_set_num_tc); */ int netif_set_real_num_tx_queues(struct net_device *dev, unsigned int txq) { + bool disabling; int rc; + disabling = txq < dev->real_num_tx_queues; + if (txq < 1 || txq > dev->num_tx_queues) return -EINVAL; @@ -2399,15 +2402,19 @@ int netif_set_real_num_tx_queues(struct net_device *dev, unsigned int txq) if (dev->num_tc) netif_setup_tc(dev, txq); - if (txq < dev->real_num_tx_queues) { + dev->real_num_tx_queues = txq; + + if (disabling) { + synchronize_net(); qdisc_reset_all_tx_gt(dev, txq); #ifdef CONFIG_XPS netif_reset_xps_queues_gt(dev, txq); #endif } + } else { + dev->real_num_tx_queues = txq; } - dev->real_num_tx_queues = txq; return 0; } EXPORT_SYMBOL(netif_set_real_num_tx_queues);