netdev - [PATCH net-next] ibmvnic: fix rx buffer tracking and index management in replenish_rx

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20201210015331.44966-1-drt@linux.ibm.com>
Date:   Wed,  9 Dec 2020 20:53:31 -0500
From:   Dany Madden <drt@...ux.ibm.com>
To:     davem@...emloft.net, kuba@...nel.org
Cc:     dnbanerg@...ibm.com, drt@...ux.ibm.com, ljp@...ux.ibm.com,
        sukadev@...ux.ibm.com, netdev@...r.kernel.org
Subject: [PATCH net-next] ibmvnic: fix rx buffer tracking and index management in replenish_rx_pool partial success

From: "Dwip N. Banerjee" <dnbanerg@...ibm.com>

We observed that in the error case for batched send_subcrq_indirect() the
driver does not account for the partial success case. This caused Linux to
crash when free_map and pool index are inconsistent.

Driver needs to update the rx pools "available" count when some batched
sends worked but an error was encountered as part of the whole operation.
Also track replenish_add_buff_failure for statistic purposes.

Fixes: 4f0b6812e9b9a ("ibmvnic: Introduce batched RX buffer descriptor transmission")
Signed-off-by: Dwip N. Banerjee <dnbanerg@...ibm.com>
Reviewed-by: Dany Madden <drt@...ux.ibm.com>
---
 drivers/net/ethernet/ibm/ibmvnic.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
index cb701a6c0712..a2191392ca4f 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -398,6 +398,8 @@ static void replenish_rx_pool(struct ibmvnic_adapter *adapter,
 		dev_kfree_skb_any(pool->rx_buff[index].skb);
 		pool->rx_buff[index].skb = NULL;
 	}
+	adapter->replenish_add_buff_failure += ind_bufp->index;
+	atomic_add(buffers_added, &pool->available);
 	ind_bufp->index = 0;
 	if (lpar_rc == H_CLOSED || adapter->failover_pending) {
 		/* Disable buffer pool replenishment and report carrier off if
-- 
2.18.2