netdev - [PATCH] net: Fix xps_needed inc/dec mismatch

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20181207101621.24316-1-ross.lagerwall@citrix.com>
Date:   Fri, 7 Dec 2018 10:16:21 +0000
From:   Ross Lagerwall <ross.lagerwall@...rix.com>
To:     <netdev@...r.kernel.org>
CC:     "David S. Miller" <davem@...emloft.net>,
        Amritha Nambiar <amritha.nambiar@...el.com>,
        Ross Lagerwall <ross.lagerwall@...rix.com>
Subject: [PATCH] net: Fix xps_needed inc/dec mismatch

xps_needed is incremented only when a new dev map is allocated (in
__netif_set_xps_queue). Therefore it should be decremented only when we
actually have a dev map to destroy. Without this, it may be decremented
too many times which causes netif_reset_xps_queues to return early and
not actually clean up the old dev maps. This results in a crash in
__netif_set_xps_queue when it is called later.

The crash occurred when having multiple ixgbe devices in a host. lldpad
would reconfigure them to be FCoE-capable causing reset_xps_queues /
set_xps_queue to be called several times. The xps_needed count would get
out of sync and eventually the above-mentioned crash would occur.

Signed-off-by: Ross Lagerwall <ross.lagerwall@...rix.com>
---
 net/core/dev.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/core/dev.c b/net/core/dev.c
index ddc551f24ba2..8aa72e93af9f 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2233,11 +2233,12 @@ static void netif_reset_xps_queues(struct net_device *dev, u16 offset,
 	clean_xps_maps(dev, possible_mask, dev_maps, nr_ids, offset, count,
 		       false);

-out_no_maps:
 	if (static_key_enabled(&xps_rxqs_needed))
 		static_key_slow_dec_cpuslocked(&xps_rxqs_needed);

 	static_key_slow_dec_cpuslocked(&xps_needed);
+
+out_no_maps:
 	mutex_unlock(&xps_map_mutex);
 	cpus_read_unlock();
 }
-- 
2.17.1