From patchwork Tue Aug 25 17:27:33 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?b?QmrDtnJuIFTDtnBlbA==?= X-Patchwork-Id: 1351189 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=osuosl.org (client-ip=140.211.166.138; helo=whitealder.osuosl.org; envelope-from=intel-wired-lan-bounces@osuosl.org; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=gmail.com Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20161025 header.b=apeSbu/S; dkim-atps=neutral Received: from whitealder.osuosl.org (smtp1.osuosl.org [140.211.166.138]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 4BbbYG1n5rz9sTR for ; Wed, 26 Aug 2020 03:28:01 +1000 (AEST) Received: from localhost (localhost [127.0.0.1]) by whitealder.osuosl.org (Postfix) with ESMTP id 34AC3882BB; Tue, 25 Aug 2020 17:27:59 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from whitealder.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6GYjJalGiFNj; Tue, 25 Aug 2020 17:27:56 +0000 (UTC) Received: from ash.osuosl.org (ash.osuosl.org [140.211.166.34]) by whitealder.osuosl.org (Postfix) with ESMTP id B2DC188247; Tue, 25 Aug 2020 17:27:56 +0000 (UTC) X-Original-To: intel-wired-lan@lists.osuosl.org Delivered-To: intel-wired-lan@lists.osuosl.org Received: from whitealder.osuosl.org (smtp1.osuosl.org [140.211.166.138]) by ash.osuosl.org (Postfix) with ESMTP id C0B941BF41C for ; Tue, 25 Aug 2020 17:27:54 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by whitealder.osuosl.org (Postfix) with ESMTP id B96FD881DA for ; Tue, 25 Aug 2020 17:27:54 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from whitealder.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UQI8J+pm00x8 for ; Tue, 25 Aug 2020 17:27:54 +0000 (UTC) X-Greylist: domain auto-whitelisted by SQLgrey-1.7.6 Received: from mail-pj1-f66.google.com (mail-pj1-f66.google.com [209.85.216.66]) by whitealder.osuosl.org (Postfix) with ESMTPS id 0C793882CE for ; Tue, 25 Aug 2020 17:27:51 +0000 (UTC) Received: by mail-pj1-f66.google.com with SMTP id q1so1586685pjd.1 for ; Tue, 25 Aug 2020 10:27:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=R96er/PUVvfadsqAyZv+jNgEaJpcty4Nzo7grHpCEwo=; b=apeSbu/SUCX4n2tlsVngUvy9gGtEQOK9BDjzH4FDbB2y1L2RKRDtTeXhbaFatRa4lk k0zgA3E75zj1asMXPBXfD34AMSrQTUqEm+eipH/W/zscyEfppmLasI2KnQh9TlvKisGm e5a96y6rtGooDV1nW2wgVx5wJ5mwkQNvz7nkTQeD6k1ZMcAKiADm10/Goqn5sUmNNKQE n1bby2NcH/HUOQnnz4gOjtounHXOTQs2K5C9z+QryO/HaLjhDv9GLL0us6ztfWbfFKtm RIm1NQ6iIplIIIo31Ikjs+vUh4gme6BvffX1zhXifU+Xzc0/cIeVN9GI1T06VxK0Lke3 Evpg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=R96er/PUVvfadsqAyZv+jNgEaJpcty4Nzo7grHpCEwo=; b=jfi1ZOe+DkMjgju0hhBHes0Qt1ytdLZTGXZSN5TFIuME6PANth2z7kX8AUtFtiVq+4 kccufTNudWTs4EaCh9yFoQsBDE9dXrELrHYWdlagpa0kH+rdOtDVvcDjAlxW8F9hBKyl QGPL1/TSOf5hBoMO12TaeYyyV1ZR0spqBR2AjziTOzKUt1j+dhb54sjh0dQyB9U/HRDZ 9mtgJHYncdA7CdEFtFieYnVz9tCPKu9Ap1j2UvI1xXvexlt3E6D4fk86FPdvIuuKmf9A RKrG1SY4yCbINmIblrrLnWpcE8Eyxrt4jd4cdMNphPOAh7lImp0Bze5GM0aFQfl7uVSL 8ryQ== X-Gm-Message-State: AOAM530tzzml0R7uBpZQ+Bs2Pt6cpb1yncUbwlmLR0WqDcmm2ww+t8k6 Zw6zWf+vRqB+Pm48VdNk/d8= X-Google-Smtp-Source: ABdhPJxQtVm46T/KQ/dnkbqg0kkC84ILQee1EL+5QmQ6iMdHInpMtTQZ2saxctC7G0GXeiNNNYlVlQ== X-Received: by 2002:a17:90b:c97:: with SMTP id o23mr2514529pjz.216.1598376470570; Tue, 25 Aug 2020 10:27:50 -0700 (PDT) Received: from btopel-mobl.ger.intel.com ([134.134.137.77]) by smtp.gmail.com with ESMTPSA id n72sm11685763pfd.93.2020.08.25.10.27.44 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 25 Aug 2020 10:27:49 -0700 (PDT) From: =?utf-8?b?QmrDtnJuIFTDtnBlbA==?= To: jeffrey.t.kirsher@intel.com, intel-wired-lan@lists.osuosl.org Date: Tue, 25 Aug 2020 19:27:33 +0200 Message-Id: <20200825172736.27318-1-bjorn.topel@gmail.com> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 Subject: [Intel-wired-lan] [PATCH net v3 0/3] Avoid premature Rx buffer reuse for XDP_REDIRECT X-BeenThere: intel-wired-lan@osuosl.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Intel Wired Ethernet Linux Kernel Driver Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: maciej.fijalkowski@intel.com, maciej.machnikowski@intel.com, lirongqing@baidu.com, netdev@vger.kernel.org, magnus.karlsson@intel.com Errors-To: intel-wired-lan-bounces@osuosl.org Sender: "Intel-wired-lan" Intel NICs have a recycle mechanism. The main idea is that a page is split into two parts. One part is owned by the driver, one part might be owned by someone else, such as the stack. The page recycle code, incorrectly, relied on that a page fragment could not be freed inside xdp_do_redirect(), e.g. a redirect to a devmap where the ndo_xdp_xmit() implementation would transmit and free the frame, or xskmap where the frame would be copied to userspace and freed. This assumption leads to that page fragments that are used by the stack/XDP redirect can be reused and overwritten. To avoid this, store the page count prior invoking xdp_do_redirect(). The affected drivers are ixgbe, ice, and i40e. An example how things might go wrong: t0: Page is allocated, and put on the Rx ring +--------------- used by NIC ->| upper buffer (rx_buffer) +--------------- | lower buffer +--------------- page count == USHRT_MAX rx_buffer->pagecnt_bias == USHRT_MAX t1: Buffer is received, and passed to the stack (e.g.) +--------------- | upper buff (skb) +--------------- used by NIC ->| lower buffer (rx_buffer) +--------------- page count == USHRT_MAX rx_buffer->pagecnt_bias == USHRT_MAX - 1 t2: Buffer is received, and redirected +--------------- | upper buff (skb) +--------------- used by NIC ->| lower buffer (rx_buffer) +--------------- Now, prior calling xdp_do_redirect(): page count == USHRT_MAX rx_buffer->pagecnt_bias == USHRT_MAX - 2 This means that buffer *cannot* be flipped/reused, because the skb is still using it. The problem arises when xdp_do_redirect() actually frees the segment. Then we get: page count == USHRT_MAX - 1 rx_buffer->pagecnt_bias == USHRT_MAX - 2 From a recycle perspective, the buffer can be flipped and reused, which means that the skb data area is passed to the Rx HW ring! To work around this, the page count is stored prior calling xdp_do_redirect(). Note that this is not optimal, since the NIC could actually reuse the "lower buffer" again. However, then we need to track whether XDP_REDIRECT consumed the buffer or not. This scenario is very rare, and tracking consumtion status would introduce more complexity. A big thanks to Li RongQing from Baidu for having patience with me understanding that there was a bug. I would have given up much earlier! :-) Cheers, Björn v2->v3: Fixed kdoc for i40e/ice. (Jakub) v1->v2: Removed page count function into get Rx buffer function, and changed scope of automatic variable. (Maciej) Björn Töpel (3): i40e: avoid premature Rx buffer reuse ixgbe: avoid premature Rx buffer reuse ice: avoid premature Rx buffer reuse drivers/net/ethernet/intel/i40e/i40e_txrx.c | 27 ++++++++++++----- drivers/net/ethernet/intel/ice/ice_txrx.c | 30 +++++++++++++------ drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 24 ++++++++++----- 3 files changed, 58 insertions(+), 23 deletions(-) base-commit: 99408c422d336db32bfab5cbebc10038a70cf7d2 Reviewed-by: Maciej Fijalkowski