| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20090804202103.GC9924@neterion.com>
Date: Tue, 4 Aug 2009 16:21:03 -0400
From: Benjamin LaHaise <ben.lahaise@...erion.com>
To: netdev@...r.kernel.org
Subject: [2/6] vxge: fix pktgen hangs (don't abuse skb->cb[])
This patch fixes a case in the transmit completion code which was resulting
in pktgen hanging at the end of a run. The cause is due to the fact that
the ->cb[] area of an skb cannot be used in a network driver's transmit
path, as that area belongs to the network protocol. Pktgen hangs, as it
sends out the same packet multiple times, and vxge's use of this area of
the skb for a temporary list can only add the packet to the temporary list
once (while it may be on the queue many times). The fix is to remove this
abuse of skb->cb[]. Instead, skb pointers are placed into a temporary
stack array, and then free outside of the tx lock. This retains the smp
optimization of doing dev_kfree_skb() outside of the tx lock.
Signed-off-by: Benjamin LaHaise <ben.lahaise@...erion.com>
Signed-off-by: Sreenivasa Honnur <sreenivasa.honnur@...erion.com>
Signed-off-by: Ramkrishna Vepa <ram.vepa@...erion.com>
---
drivers/net/vxge/vxge-config.h | 7 ++++-
drivers/net/vxge/vxge-main.c | 51 ++++++++++++++++++++------------------
drivers/net/vxge/vxge-main.h | 3 +-
drivers/net/vxge/vxge-traffic.c | 7 +++--
drivers/net/vxge/vxge-traffic.h | 2 +-
5 files changed, 39 insertions(+), 31 deletions(-)
diff --git a/drivers/net/vxge/vxge-config.h b/drivers/net/vxge/vxge-config.h
index 224acea..62779a5 100644
--- a/drivers/net/vxge/vxge-config.h
+++ b/drivers/net/vxge/vxge-config.h
@@ -978,7 +978,9 @@ struct __vxge_hw_fifo {
void *txdlh,
enum vxge_hw_fifo_tcode t_code,
void *userdata,
- void **skb_ptr);
+ struct sk_buff ***skb_ptr,
+ int nr_skb,
+ int *more);
void (*txdl_term)(
void *txdlh,
@@ -1779,7 +1781,8 @@ struct vxge_hw_fifo_attr {
void *txdlh,
enum vxge_hw_fifo_tcode t_code,
void *userdata,
- void **skb_ptr);
+ struct sk_buff ***skb_ptr,
+ int nr_skb, int *more);
void (*txdl_term)(
void *txdlh,
diff --git a/drivers/net/vxge/vxge-main.c b/drivers/net/vxge/vxge-main.c
index 7c2241c..2e4d362 100644
--- a/drivers/net/vxge/vxge-main.c
+++ b/drivers/net/vxge/vxge-main.c
@@ -87,22 +87,25 @@ static inline int is_vxge_card_up(struct vxgedev *vdev)
static inline void VXGE_COMPLETE_VPATH_TX(struct vxge_fifo *fifo)
{
unsigned long flags = 0;
- struct sk_buff *skb_ptr = NULL;
- struct sk_buff **temp, *head, *skb;
-
- if (spin_trylock_irqsave(&fifo->tx_lock, flags)) {
- vxge_hw_vpath_poll_tx(fifo->handle, (void **)&skb_ptr);
- spin_unlock_irqrestore(&fifo->tx_lock, flags);
- }
- /* free SKBs */
- head = skb_ptr;
- while (head) {
- skb = head;
- temp = (struct sk_buff **)&skb->cb;
- head = *temp;
- *temp = NULL;
- dev_kfree_skb_irq(skb);
- }
+ struct sk_buff **skb_ptr = NULL;
+ struct sk_buff **temp;
+#define NR_SKB_COMPLETED 128
+ struct sk_buff *completed[NR_SKB_COMPLETED];
+ int more;
+
+ do {
+ more = 0;
+ skb_ptr = completed;
+
+ if (spin_trylock_irqsave(&fifo->tx_lock, flags)) {
+ vxge_hw_vpath_poll_tx(fifo->handle, &skb_ptr,
+ NR_SKB_COMPLETED, &more);
+ spin_unlock_irqrestore(&fifo->tx_lock, flags);
+ }
+ /* free SKBs */
+ for (temp = completed; temp != skb_ptr; temp++)
+ dev_kfree_skb_irq(*temp);
+ } while (more) ;
}
static inline void VXGE_COMPLETE_ALL_TX(struct vxgedev *vdev)
@@ -600,11 +603,10 @@ vxge_rx_1b_compl(struct __vxge_hw_ring *ringh, void *dtr,
enum vxge_hw_status
vxge_xmit_compl(struct __vxge_hw_fifo *fifo_hw, void *dtr,
enum vxge_hw_fifo_tcode t_code, void *userdata,
- void **skb_ptr)
+ struct sk_buff ***skb_ptr, int nr_skb, int *more)
{
struct vxge_fifo *fifo = (struct vxge_fifo *)userdata;
- struct sk_buff *skb, *head = NULL;
- struct sk_buff **temp;
+ struct sk_buff *skb, **done_skb = *skb_ptr;
int pkt_cnt = 0;
vxge_debug_entryexit(VXGE_TRACE,
@@ -657,9 +659,12 @@ vxge_xmit_compl(struct __vxge_hw_fifo *fifo_hw, void *dtr,
fifo->stats.tx_frms++;
fifo->stats.tx_bytes += skb->len;
- temp = (struct sk_buff **)&skb->cb;
- *temp = head;
- head = skb;
+ *done_skb++ = skb;
+
+ if (--nr_skb <= 0) {
+ *more = 1;
+ break;
+ }
pkt_cnt++;
if (pkt_cnt > fifo->indicate_max_pkts)
@@ -668,11 +673,9 @@ vxge_xmit_compl(struct __vxge_hw_fifo *fifo_hw, void *dtr,
} while (vxge_hw_fifo_txdl_next_completed(fifo_hw,
&dtr, &t_code) == VXGE_HW_OK);
+ *skb_ptr = done_skb;
vxge_wake_tx_queue(fifo, skb);
- if (skb_ptr)
- *skb_ptr = (void *) head;
-
vxge_debug_entryexit(VXGE_TRACE,
"%s: %s:%d Exiting...",
fifo->ndev->name, __func__, __LINE__);
diff --git a/drivers/net/vxge/vxge-main.h b/drivers/net/vxge/vxge-main.h
index 18d824c..8b3989b 100644
--- a/drivers/net/vxge/vxge-main.h
+++ b/drivers/net/vxge/vxge-main.h
@@ -428,7 +428,8 @@ vxge_rx_1b_compl(struct __vxge_hw_ring *ringh, void *dtr,
enum vxge_hw_status
vxge_xmit_compl(struct __vxge_hw_fifo *fifo_hw, void *dtr,
- enum vxge_hw_fifo_tcode t_code, void *userdata, void **skb_ptr);
+ enum vxge_hw_fifo_tcode t_code, void *userdata,
+ struct sk_buff ***skb_ptr, int nr_skbs, int *more);
int vxge_close(struct net_device *dev);
diff --git a/drivers/net/vxge/vxge-traffic.c b/drivers/net/vxge/vxge-traffic.c
index 370f55c..c249cd2 100644
--- a/drivers/net/vxge/vxge-traffic.c
+++ b/drivers/net/vxge/vxge-traffic.c
@@ -2508,7 +2508,8 @@ enum vxge_hw_status vxge_hw_vpath_poll_rx(struct __vxge_hw_ring *ring)
* See also: vxge_hw_vpath_poll_tx().
*/
enum vxge_hw_status vxge_hw_vpath_poll_tx(struct __vxge_hw_fifo *fifo,
- void **skb_ptr)
+ struct sk_buff ***skb_ptr, int nr_skb,
+ int *more)
{
enum vxge_hw_fifo_tcode t_code;
void *first_txdlh;
@@ -2520,8 +2521,8 @@ enum vxge_hw_status vxge_hw_vpath_poll_tx(struct __vxge_hw_fifo *fifo,
status = vxge_hw_fifo_txdl_next_completed(fifo,
&first_txdlh, &t_code);
if (status == VXGE_HW_OK)
- if (fifo->callback(fifo, first_txdlh,
- t_code, channel->userdata, skb_ptr) != VXGE_HW_OK)
+ if (fifo->callback(fifo, first_txdlh, t_code,
+ channel->userdata, skb_ptr, nr_skb, more) != VXGE_HW_OK)
status = VXGE_HW_COMPLETIONS_REMAIN;
return status;
diff --git a/drivers/net/vxge/vxge-traffic.h b/drivers/net/vxge/vxge-traffic.h
index 8260b91..461742b 100644
--- a/drivers/net/vxge/vxge-traffic.h
+++ b/drivers/net/vxge/vxge-traffic.h
@@ -2326,7 +2326,7 @@ enum vxge_hw_status vxge_hw_vpath_poll_rx(
enum vxge_hw_status vxge_hw_vpath_poll_tx(
struct __vxge_hw_fifo *fifoh,
- void **skb_ptr);
+ struct sk_buff ***skb_ptr, int nr_skb, int *more);
enum vxge_hw_status vxge_hw_vpath_alarm_process(
struct __vxge_hw_vpath_handle *vpath_handle,
--
1.6.0.6
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists