netdev - Re: [Bug, PATCH and another Bug] Was: Fix refcounting problem with netif_rx

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <200709191523.48874.ossthema@de.ibm.com>
Date:	Wed, 19 Sep 2007 15:23:48 +0200
From:	Jan-Bernd Themann <ossthema@...ibm.com>
To:	Krishna Kumar <krkumar2@...ibm.com>
Cc:	davem@...emloft.net, netdev@...r.kernel.org, rdreier@...co.com,
	general@...ts.openfabrics.org, Christoph Raisch <raisch@...ibm.com>
Subject: Re: [Bug, PATCH and another Bug] Was: Fix refcounting problem with netif_rx_reschedule()

Hi,

On Wednesday 19 September 2007 13:54, Krishna Kumar wrote:
> CPU#1: ipoib_poll(budget=100)
> {
> 	A. process 100 skbs
> 	B. netif_rx_complete()
> 	<Process unrelated interrupts; executes slower than steps C, D, E on
> 	 CPU#2>
> 	F. ib_req_notify_cq() (no missed completions, do nothing)
> 	G. return 100
> 	H. return to net_rx_action, quota=99, subtract 100, quota=-1, BUG.
> }
> 
> CPU#2: ipoib_ib_completion() : (starts and finishes entire line of execution
> 				*after* step B and *before* H executes).
> {
> 	C. New skb comes, call netif_rx_schedule; set quota=100
> 	D. do ipoib_poll(), process one skb, return work=1 to net_rx_action
> 	E. net_rx_action: set quota=99
> }

If I understood it right the problem you describe (quota update in 
__napi_schdule) can cause further problems when you choose the
following numbers:

CPU1: A. process 99 pkts
CPU1: B. netif_rx_complete()
CPU2: interrupt occures, netif_rx_schedule is called, net_rx_action triggerd:
CPU2: C. set quota = 100 (__napi_schedule)
CPU2: D. call poll(), process 1 pkt
CPU2: D.2 call netif_rx_complete() (quota not exeeded)
CPU2: E. net_rx_action: set quota=99
CPU1: F. net_rx_action: set qutoa=99 - 99 = 0
CPU1: G. modify list (list_move_tail) altough netif_rx_complete has been called

Step G would fail as the device is not in the list due 
to netif_rx_complete. This case can occur for all
devices running on an SMP system where interrupts are not pinned.

Regards,
Jan-Bernd

-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html