Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   "Penigalapati, Sandeep" <sandeep.penigalapati@intel.com>
To:     Feng zhou <zhoufeng.zf@bytedance.com>,
        "Brandeburg, Jesse" <jesse.brandeburg@intel.com>,
        "Nguyen, Anthony L" <anthony.l.nguyen@intel.com>,
        "davem@davemloft.net" <davem@davemloft.net>,
        "kuba@kernel.org" <kuba@kernel.org>,
        "ast@kernel.org" <ast@kernel.org>,
        "daniel@iogearbox.net" <daniel@iogearbox.net>,
        "hawk@kernel.org" <hawk@kernel.org>,
        "john.fastabend@gmail.com" <john.fastabend@gmail.com>,
        "jeffrey.t.kirsher@intel.com" <jeffrey.t.kirsher@intel.com>,
        "Karlsson, Magnus" <magnus.karlsson@intel.com>,
        "Fijalkowski, Maciej" <maciej.fijalkowski@intel.com>
CC:     "duanxiongchun@bytedance.com" <duanxiongchun@bytedance.com>,
        "netdev@vger.kernel.org" <netdev@vger.kernel.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "zhengqi.arch@bytedance.com" <zhengqi.arch@bytedance.com>,
        "chenying.kernel@bytedance.com" <chenying.kernel@bytedance.com>,
        "intel-wired-lan@lists.osuosl.org" <intel-wired-lan@lists.osuosl.org>,
        "songmuchun@bytedance.com" <songmuchun@bytedance.com>,
        "bpf@vger.kernel.org" <bpf@vger.kernel.org>,
        "wangdongdong.6@bytedance.com" <wangdongdong.6@bytedance.com>,
        "zhouchengming@bytedance.com" <zhouchengming@bytedance.com>
Subject: RE: [Intel-wired-lan] [PATCH v3] ixgbe: Fix NULL pointer dereference
 in ixgbe_xdp_setup
Thread-Topic: [Intel-wired-lan] [PATCH v3] ixgbe: Fix NULL pointer dereference
 in ixgbe_xdp_setup
Thread-Index: AQHXqgARPe10IxtL/0exW61B+339qau47EmQ
Date:   Tue, 28 Sep 2021 04:21:13 +0000
Message-ID: <MW3PR11MB45543254E1F9F87512A25A6F9CA89@MW3PR11MB4554.namprd11.prod.outlook.com>
References: <20210915070440.6540-1-zhoufeng.zf@bytedance.com>
In-Reply-To: <20210915070440.6540-1-zhoufeng.zf@bytedance.com>
Accept-Language: en-US
Content-Language: en-US
dlp-reaction: no-action
dlp-version: 11.6.200.16
dlp-product: dlpe-windows
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?gL0UoDRKyf7YmHgWl8ALomvooPf09bgB8Tj+aHFb+JbsV8ZzwPI8Gz6cY0TQ?=
 =?us-ascii?Q?HiIUXwCTZ8t0woxbfTzBLzgFrfEwsTBh7q9Hiz+yAZvFqhDwOC07JNjQy5O4?=
 =?us-ascii?Q?JuMFjsOIFj/qALZEc8ub5Zb2I5F5nBHY2+KlLw86Zcwdbkt+5l3fGUuWkYqr?=
 =?us-ascii?Q?Gnlzun5sIef3PssiXWL5bZ6G60PbfSr/wqUrGBbzZXM7ZVEXqRnpT5pT4O2p?=
 =?us-ascii?Q?dXBBFR0xRXim6ci9AFATp+qo7lhD2h+LUEyMY3CbOuYOw8VtDhWOC1YlDG2X?=
 =?us-ascii?Q?g0iZTeSDeCWBK57MSgBQScCjPA3rtrHMTcC+01ubVitzGpuOnv9D87h2qflA?=
 =?us-ascii?Q?/67jDnMRhQ5t5sd8a3iGxY0KCIyNHJsugaPX1zQCfwJXXY7/xTyHo8kPQUX/?=
 =?us-ascii?Q?C4Q8e1V5NtlhKgVkKCmMmDCotoihDks0+ifyDL1RT7iBQ4yc4Y+tSDzrWJr/?=
 =?us-ascii?Q?8BC83fPAEkjRW2+Py2n6NVgQQS9rBPPT6F//axxCtm1Dc9ED3SSQb2GxuTX1?=
 =?us-ascii?Q?DuGwsCreHCP2hygLth2Dr/xHMeyWtAnk9Bw9yQpnn/5bCToTW0htOpg6LFwX?=
 =?us-ascii?Q?jqgs/Ev+dZb1Y6LKVEzBNpyyjg4fHv/8YhjS3wrxj+cH/TT95F5ltg6UYSfr?=
 =?us-ascii?Q?AabnSrY02qIkJyiZCFdfI/6dNazvb3TwW77jiYze4OALtULmJg1evGfVD7vU?=
 =?us-ascii?Q?ld9MI/fgpzbfarbg3bKyFG71kS7uuj4aTbKrRXUiTjOKK2UfNi+aP9M19lP1?=
 =?us-ascii?Q?RKGneKBSf42qpUrvWYnvUAb8k9HfBtSO/D5EPpQ401d7YpCqvwo8L36JlMKu?=
 =?us-ascii?Q?h1iwHcnS7NYnXd6l/JN4z4NM3IjTtX+2zH7IeBmdtSPOPdcaukR+pVw6fNf1?=
 =?us-ascii?Q?M3upv/m2r7xnN5PeKhuBFLuPdeCxgyl6IlKLdT9UYY8La+tHOK6bntWWmtLH?=
 =?us-ascii?Q?e6sAYgfTxQw9/sR0XXHoduas+gf2j5vEoGDLSTMiL3ymBpDc4FBFwBfscwTc?=
 =?us-ascii?Q?zx2iyKrY7CYhPbeToOlRfXfSjUiA+xxvsGc28iNqq4mUfF3ebYvIb1Kc/jrQ?=
 =?us-ascii?Q?ELuGfgxafEhv4GucMGjuUq1kVZPnDmeSNygkefMMCyRi+o/u3b8tZekV3hYl?=
 =?us-ascii?Q?HRHITox1skk3ZySC0snCYpwrytADuzZpDmQM6b82juP1wZTc+aW2/R8NmaEX?=
 =?us-ascii?Q?4MWkQ4LiM4W14izBejMS+QrSgnA9dnj2Uv+VCYcqaqNpYs2LAzhGuRr8JVXT?=
 =?us-ascii?Q?Swrs2x/t5dSgm6sriN0Q1WUVo66uCZz63n8LQWfS5P/ur/Et5EF3VOK4s1Ob?=
 =?us-ascii?Q?xBX6sQmQ1QrGwTuRwFWv5UdC?=
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: MW3PR11MB4554.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: d851acdb-e5b8-49e1-0be2-08d982376860
X-MS-Exchange-CrossTenant-originalarrivaltime: 28 Sep 2021 04:21:13.4198
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 46c98d88-e344-4ed4-8496-4ed7712e255d
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: +A+zvKiqlDOXH+aXgrrW1QcNVa58ernEz3a4u7fPzyveQJ4NfsOSRjXwJnSuOMLUXAXPGuJ1uyaemleFcrslWi5d+/qLHnQv7u2wjwz38dc=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CO1PR11MB4914
X-OriginatorOrg: intel.com
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

>-----Original Message-----
>From: Intel-wired-lan <intel-wired-lan-bounces@osuosl.org> On Behalf Of
>Feng zhou
>Sent: Wednesday, September 15, 2021 12:35 PM
>To: Brandeburg, Jesse <jesse.brandeburg@intel.com>; Nguyen, Anthony L
><anthony.l.nguyen@intel.com>; davem@davemloft.net; kuba@kernel.org;
>ast@kernel.org; daniel@iogearbox.net; hawk@kernel.org;
>john.fastabend@gmail.com; jeffrey.t.kirsher@intel.com; Karlsson, Magnus
><magnus.karlsson@intel.com>; Fijalkowski, Maciej
><maciej.fijalkowski@intel.com>
>Cc: duanxiongchun@bytedance.com; netdev@vger.kernel.org; linux-
>kernel@vger.kernel.org; zhengqi.arch@bytedance.com;
>chenying.kernel@bytedance.com; intel-wired-lan@lists.osuosl.org;
>songmuchun@bytedance.com; zhoufeng.zf@bytedance.com;
>bpf@vger.kernel.org; wangdongdong.6@bytedance.com;
>zhouchengming@bytedance.com
>Subject: [Intel-wired-lan] [PATCH v3] ixgbe: Fix NULL pointer dereference =
in
>ixgbe_xdp_setup
>
>From: Feng Zhou <zhoufeng.zf@bytedance.com>
>
>The ixgbe driver currently generates a NULL pointer dereference with some
>machine (online cpus < 63). This is due to the fact that the maximum value=
 of
>num_xdp_queues is nr_cpu_ids. Code is in "ixgbe_set_rss_queues"".
>
>Here's how the problem repeats itself:
>Some machine (online cpus < 63), And user set num_queues to 63 through
>ethtool. Code is in the "ixgbe_set_channels",
>	adapter->ring_feature[RING_F_FDIR].limit =3D count;
>
>It becomes 63.
>
>When user use xdp, "ixgbe_set_rss_queues" will set queues num.
>	adapter->num_rx_queues =3D rss_i;
>	adapter->num_tx_queues =3D rss_i;
>	adapter->num_xdp_queues =3D ixgbe_xdp_queues(adapter);
>
>And rss_i's value is from
>	f =3D &adapter->ring_feature[RING_F_FDIR];
>	rss_i =3D f->indices =3D f->limit;
>
>So "num_rx_queues" > "num_xdp_queues", when run to "ixgbe_xdp_setup",
>	for (i =3D 0; i < adapter->num_rx_queues; i++)
>		if (adapter->xdp_ring[i]->xsk_umem)
>
>It leads to panic.
>
>Call trace:
>[exception RIP: ixgbe_xdp+368]
>RIP: ffffffffc02a76a0  RSP: ffff9fe16202f8d0  RFLAGS: 00010297
>RAX: 0000000000000000  RBX: 0000000000000020  RCX: 0000000000000000
>RDX: 0000000000000000  RSI: 000000000000001c  RDI: ffffffffa94ead90
>RBP: ffff92f8f24c0c18   R8: 0000000000000000   R9: 0000000000000000
>R10: ffff9fe16202f830  R11: 0000000000000000  R12: ffff92f8f24c0000
>R13: ffff9fe16202fc01  R14: 000000000000000a  R15: ffffffffc02a7530
>ORIG_RAX: ffffffffffffffff  CS: 0010  SS: 0018
> 7 [ffff9fe16202f8f0] dev_xdp_install at ffffffffa89fbbcc
> 8 [ffff9fe16202f920] dev_change_xdp_fd at ffffffffa8a08808
> 9 [ffff9fe16202f960] do_setlink at ffffffffa8a20235
>10 [ffff9fe16202fa88] rtnl_setlink at ffffffffa8a20384
>11 [ffff9fe16202fc78] rtnetlink_rcv_msg at ffffffffa8a1a8dd
>12 [ffff9fe16202fcf0] netlink_rcv_skb at ffffffffa8a717eb
>13 [ffff9fe16202fd40] netlink_unicast at ffffffffa8a70f88
>14 [ffff9fe16202fd80] netlink_sendmsg at ffffffffa8a71319
>15 [ffff9fe16202fdf0] sock_sendmsg at ffffffffa89df290
>16 [ffff9fe16202fe08] __sys_sendto at ffffffffa89e19c8
>17 [ffff9fe16202ff30] __x64_sys_sendto at ffffffffa89e1a64
>18 [ffff9fe16202ff38] do_syscall_64 at ffffffffa84042b9
>19 [ffff9fe16202ff50] entry_SYSCALL_64_after_hwframe at ffffffffa8c0008c
>
>So I fix ixgbe_max_channels so that it will not allow a setting of queues =
to be
>higher than the num_online_cpus(). And when run to ixgbe_xdp_setup, take
>the smaller value of num_rx_queues and num_xdp_queues.
>
>Fixes: 4a9b32f30f80 ("ixgbe: fix potential RX buffer starvation for
>AF_XDP")
>Signed-off-by: Feng Zhou <zhoufeng.zf@bytedance.com>
>---
>v1:
>- Fix "ixgbe_max_channels" callback so that it will not allow a setting of
>queues to be higher than the num_online_cpus().
>v2:
>- Modify commit message
>more details can be seen from here:
>https://patchwork.ozlabs.org/project/intel-wired-
>lan/patch/20210817075407.11961-1-zhoufeng.zf@bytedance.com/
>https://lore.kernel.org/netdev/20210903064013.9842-1-
>zhoufeng.zf@bytedance.com/
>Thanks to Maciej Fijalkowski and Paul Menzel for yours advice.
>
> drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c | 2 +-
> drivers/net/ethernet/intel/ixgbe/ixgbe_main.c    | 8 ++++++--
> 2 files changed, 7 insertions(+), 3 deletions(-)
>
Tested-by: Sandeep Penigalapati <sandeep.penigalapati@intel.com>