[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20231129163618.GD43811@kernel.org>
Date: Wed, 29 Nov 2023 16:36:18 +0000
From: Simon Horman <horms@...nel.org>
To: Ivan Vecera <ivecera@...hat.com>
Cc: netdev@...r.kernel.org, Jacob Keller <jacob.e.keller@...el.com>,
Wojciech Drewek <wojciech.drewek@...el.com>,
Jesse Brandeburg <jesse.brandeburg@...el.com>,
Tony Nguyen <anthony.l.nguyen@...el.com>,
"David S. Miller" <davem@...emloft.net>,
Eric Dumazet <edumazet@...gle.com>,
Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
Harshitha Ramamurthy <harshitha.ramamurthy@...el.com>,
Jeff Kirsher <jeffrey.t.kirsher@...el.com>,
"moderated list:INTEL ETHERNET DRIVERS" <intel-wired-lan@...ts.osuosl.org>,
open list <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH iwl-net] i40e: Fix kernel crash during macvlan offloading
setup
On Fri, Nov 24, 2023 at 05:42:33PM +0100, Ivan Vecera wrote:
> Function i40e_fwd_add() computes num of created channels and
> num of queues per channel according value of pf->num_lan_msix.
>
> This is wrong because the channels are used for subordinated net
> devices that reuse existing queues from parent net device and
> number of existing queue pairs (pf->num_queue_pairs) should be
> used instead.
>
> E.g.:
> Let's have (pf->num_lan_msix == 32)... Then we reduce number of
> combined queues by ethtool to 8 (so pf->num_queue_pairs == 8).
> i40e_fwd_add() called by macvlan then computes number of macvlans
> channels to be 16 and queues per channel 1 and calls
> i40e_setup_macvlans(). This computes new number of queue pairs
> for PF as:
>
> num_qps = vsi->num_queue_pairs - (macvlan_cnt * qcnt);
>
> This is evaluated in this case as:
> num_qps = (8 - 16 * 1) = (u16)-8 = 0xFFF8
>
> ...and this number is stored vsi->next_base_queue that is used
> during channel creation. This leads to kernel crash.
>
> Fix this bug by computing the number of offloaded macvlan devices
> and no. their queues according the current number of queues instead
> of maximal one.
>
> Reproducer:
> 1) Enable l2-fwd-offload
> 2) Reduce number of queues
> 3) Create macvlan device
> 4) Make it up
>
> Result:
> [root@...-03 ~]# ethtool -K enp2s0f0np0 l2-fwd-offload on
> [root@...-03 ~]# ethtool -l enp2s0f0np0 | grep Combined
> Combined: 32
> Combined: 32
> [root@...-03 ~]# ethtool -L enp2s0f0np0 combined 8
> [root@...-03 ~]# ip link add link enp2s0f0np0 mac0 type macvlan mode bridge
> [root@...-03 ~]# ip link set mac0 up
> ...
> [ 1225.686698] i40e 0000:02:00.0: User requested queue count/HW max RSS count: 8/32
> [ 1242.399103] BUG: kernel NULL pointer dereference, address: 0000000000000118
> [ 1242.406064] #PF: supervisor write access in kernel mode
> [ 1242.411288] #PF: error_code(0x0002) - not-present page
> [ 1242.416417] PGD 0 P4D 0
> [ 1242.418950] Oops: 0002 [#1] PREEMPT SMP NOPTI
> [ 1242.423308] CPU: 26 PID: 2253 Comm: ip Kdump: loaded Not tainted 6.7.0-rc1+ #20
> [ 1242.430607] Hardware name: Abacus electric, s.r.o. - servis@...cus.cz Super Server/H12SSW-iN, BIOS 2.4 04/13/2022
> [ 1242.440850] RIP: 0010:i40e_channel_config_tx_ring.constprop.0+0xd9/0x180 [i40e]
> [ 1242.448165] Code: 48 89 b3 80 00 00 00 48 89 bb 88 00 00 00 74 3c 31 c9 0f b7 53 16 49 8b b4 24 f0 0c 00 00 01 ca 83 c1 01 0f b7 d2 48 8b 34 d6 <48> 89 9e 18 01 00 00 49 8b b4 24 e8 0c 00 00 48 8b 14 d6 48 89 9a
> [ 1242.466902] RSP: 0018:ffffa4d52cd2f610 EFLAGS: 00010202
> [ 1242.472121] RAX: 0000000000000000 RBX: ffff9390a4ba2e40 RCX: 0000000000000001
> [ 1242.479244] RDX: 000000000000fff8 RSI: 0000000000000000 RDI: ffffffffffffffff
> [ 1242.486370] RBP: ffffa4d52cd2f650 R08: 0000000000000020 R09: 0000000000000000
> [ 1242.493494] R10: 0000000000000000 R11: 0000000100000001 R12: ffff9390b861a000
> [ 1242.500626] R13: 00000000000000a0 R14: 0000000000000010 R15: ffff9390b861a000
> [ 1242.507751] FS: 00007efda536b740(0000) GS:ffff939f4ec80000(0000) knlGS:0000000000000000
> [ 1242.515826] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 1242.521564] CR2: 0000000000000118 CR3: 000000010bd48002 CR4: 0000000000770ef0
> [ 1242.528699] PKRU: 55555554
> [ 1242.531400] Call Trace:
> [ 1242.533846] <TASK>
> [ 1242.535943] ? __die+0x20/0x70
> [ 1242.539004] ? page_fault_oops+0x76/0x170
> [ 1242.543018] ? exc_page_fault+0x65/0x150
> [ 1242.546942] ? asm_exc_page_fault+0x22/0x30
> [ 1242.551131] ? i40e_channel_config_tx_ring.constprop.0+0xd9/0x180 [i40e]
> [ 1242.557847] i40e_setup_channel.part.0+0x5f/0x130 [i40e]
> [ 1242.563167] i40e_setup_macvlans.constprop.0+0x256/0x420 [i40e]
> [ 1242.569099] i40e_fwd_add+0xbf/0x270 [i40e]
> [ 1242.573300] macvlan_open+0x16f/0x200 [macvlan]
> [ 1242.577831] __dev_open+0xe7/0x1b0
> [ 1242.581236] __dev_change_flags+0x1db/0x250
> ...
>
> Fixes: 1d8d80b4e4ff ("i40e: Add macvlan support on i40e")
> Signed-off-by: Ivan Vecera <ivecera@...hat.com>
Thanks Ivan,
I agree with the analysis and that the problem was introduced by the cited
patch.
Reviewed-by: Simon Horman <horms@...nel.org>
Powered by blists - more mailing lists