From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from smtp3.osuosl.org (smtp3.osuosl.org [140.211.166.136]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 372B5CED61E for ; Tue, 18 Nov 2025 11:32:23 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by smtp3.osuosl.org (Postfix) with ESMTP id E191060F68; Tue, 18 Nov 2025 11:32:22 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp3.osuosl.org ([127.0.0.1]) by localhost (smtp3.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id JMwUCinQY7W1; Tue, 18 Nov 2025 11:32:21 +0000 (UTC) X-Comment: SPF check N/A for local connections - client-ip=140.211.166.142; helo=lists1.osuosl.org; envelope-from=intel-wired-lan-bounces@osuosl.org; receiver= DKIM-Filter: OpenDKIM Filter v2.11.0 smtp3.osuosl.org 7B16860F58 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=osuosl.org; s=default; t=1763465541; bh=U36EJ4GyvUj1c+KWVQBGEQGDIxcP9pTwbj0Nc88XDlE=; h=From:To:Cc:Date:In-Reply-To:References:Subject:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From; b=ZCZSu4WXzgUhAV/aKyhJwfel1MJLOxZD0PLx/05Hv5WopcLmpg1kxI9ZamZnOTXsK lu2xrGeI8XwyOy7taxGKAeZToTUXeQhfbzlHPvxGcQI/74vg51bm9XpA7p7ijsU2Bu N4dM6Q49nd++QqyTQqscEs9rryqsED9P9UviKb1ka6MNdmLePNJmD/Z2UKf0HYfR02 omi105F/L8oMBxgEiX5Te8FxZS8JhfrQ8j36+YB/i0d79+RvHTu10c9Tbgwgo6cqka 10SjqlMmWJN7/snj7Kpur54vNs5CQcVePB3CxjDMiRk+Cm8dIv0h9ySU8ljGQEW/WX D8+BalMx8vYCQ== Received: from lists1.osuosl.org (lists1.osuosl.org [140.211.166.142]) by smtp3.osuosl.org (Postfix) with ESMTP id 7B16860F58; Tue, 18 Nov 2025 11:32:21 +0000 (UTC) Received: from smtp2.osuosl.org (smtp2.osuosl.org [140.211.166.133]) by lists1.osuosl.org (Postfix) with ESMTP id 60E031BA for ; Tue, 18 Nov 2025 11:32:20 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by smtp2.osuosl.org (Postfix) with ESMTP id 53A1E40202 for ; Tue, 18 Nov 2025 11:32:20 +0000 (UTC) X-Virus-Scanned: amavis at osuosl.org Received: from smtp2.osuosl.org ([127.0.0.1]) by localhost (smtp2.osuosl.org [127.0.0.1]) (amavis, port 10024) with ESMTP id 4L2BheXg21w5 for ; Tue, 18 Nov 2025 11:32:19 +0000 (UTC) Received-SPF: Pass (mailfrom) identity=mailfrom; client-ip=2607:f8b0:4864:20::1033; helo=mail-pj1-x1033.google.com; envelope-from=alessandro.d@gmail.com; receiver= DMARC-Filter: OpenDMARC Filter v1.4.2 smtp2.osuosl.org 621F84012D DKIM-Filter: OpenDKIM Filter v2.11.0 smtp2.osuosl.org 621F84012D Received: from mail-pj1-x1033.google.com (mail-pj1-x1033.google.com [IPv6:2607:f8b0:4864:20::1033]) by smtp2.osuosl.org (Postfix) with ESMTPS id 621F84012D for ; Tue, 18 Nov 2025 11:32:19 +0000 (UTC) Received: by mail-pj1-x1033.google.com with SMTP id 98e67ed59e1d1-340ba29d518so3786738a91.3 for ; Tue, 18 Nov 2025 03:32:19 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1763465539; x=1764070339; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=U36EJ4GyvUj1c+KWVQBGEQGDIxcP9pTwbj0Nc88XDlE=; b=QAMooYlPqv8xysXvHxFPedBF4kEvZI07dl+sJF7XHC58hmp6HUeMzYIYVlfPNxVNAV VzTamKJh1kEGvFRXSINPrVc0n/80zFGHiprmRNeNtb3fDgY5c2mYnW8msWVliO4tuem/ Om7CM5jKJKA0qXfhuIhPM74wpMPWJa9vT3rROlkycS0BtXMaibXjJa3BHe9h9C6EV3SJ /TKM+HnjWIijb9+1TpbYALnv4ibSNF9nzSsVQdoP8ZyGow5WzLD/ipJzs3cn0clo5E+c 9VDGKe3gvQbZ+Om643rwyeGhxMo1aAKXa36ywlX78z7rpZFtanNCn7m/iEOj71dVzY8j MjCA== X-Forwarded-Encrypted: i=1; AJvYcCU2l155mMEVMPA3M8lnb8fvcgYEM+yKzahtSaYMTKM/5k9DlbWxkRR9k7HBGl+53oL5+ohNBLTGGmv5C0Q3Bcs=@lists.osuosl.org X-Gm-Message-State: AOJu0YxtN5vp9AuCqjDMjwy3qOmDU310ZwI8wmie6YFT8lupSIm+5k4v +yofUfLnW0CslhS2UaEm9HpBVTD89hDyHSkwRy9wl9DLTds6TgVLl1/D X-Gm-Gg: ASbGnct5qHDH5yiRXYAYpcQpqPtpDRmHY91/CCAVDflxjzOHRdU9Nv9krTP2+NuAXwp TOnwTdnpYfC18HI1QszF0u/eXLWSGc9a04KOC9WfqPtA1mtmXHlZAKNJ+6h2f0UK9Mot6Uleyx4 lcnjZubtVwNbJnOYpTAWysxIyB2oFlqNTA24JtlMARYtrKq5kQFO/o8yBoQUa3IwpZNHYZJ7Bd7 F1Bdtb3dDs80ZU8IXkuf0dVrt2f8KnnJh1kvO1EWodA/rS6ol/EqJsFu24NLGCc1rlaqCzbfHOD Us93nTFF3HsGSTr0W+dxbvrz8Tra7WtuUGDin7pcIq6Azc/QY/6eGa+8BwSg6IhdfxNpI0YHuJW uNp4TTGFWx1TQSut2mpDg/zYav0A2kHof3xQVy90Co/OLBCLIeYu+myc27kHgDIIf8YIain2jw4 dthtQgqpYl4Vc9vjRHf6Ea49fWLjShiaar4icmxEhD0E3H9BCjqQ== X-Google-Smtp-Source: AGHT+IEXgXhQS/PPrYJbpAo06A+LbwNc11z1gcGQgtP5bDqE6cvj/3xMoRUdO7/TieS5wkj2K+854Q== X-Received: by 2002:a17:90b:2552:b0:340:ec8f:82d8 with SMTP id 98e67ed59e1d1-343f9ea40c1mr19277977a91.12.1763465538566; Tue, 18 Nov 2025 03:32:18 -0800 (PST) Received: from localhost.localdomain ([103.246.102.164]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-3456516d4a9sm12583736a91.11.2025.11.18.03.32.12 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Tue, 18 Nov 2025 03:32:18 -0800 (PST) From: Alessandro Decina To: netdev@vger.kernel.org Cc: Maciej Fijalkowski , "David S. Miller" , Alexei Starovoitov , Andrew Lunn , Daniel Borkmann , Eric Dumazet , Jakub Kicinski , Jesper Dangaard Brouer , John Fastabend , Paolo Abeni , Przemek Kitszel , Stanislav Fomichev , Tirthendu Sarkar , Tony Nguyen , bpf@vger.kernel.org, intel-wired-lan@lists.osuosl.org, linux-kernel@vger.kernel.org, Alessandro Decina Date: Tue, 18 Nov 2025 22:31:17 +1100 Message-Id: <20251118113117.11567-2-alessandro.d@gmail.com> X-Mailer: git-send-email 2.39.3 (Apple Git-146) In-Reply-To: <20251118113117.11567-1-alessandro.d@gmail.com> References: <20251118113117.11567-1-alessandro.d@gmail.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Mailman-Original-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1763465539; x=1764070339; darn=lists.osuosl.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=U36EJ4GyvUj1c+KWVQBGEQGDIxcP9pTwbj0Nc88XDlE=; b=cib9xdMjmAqe+Vq+uZs7iOPFBLQia0yUKmWqqK2u9nXDAgpUpzWlOoHapF7J7/z8Ka WbBtCdgzjdWumcKITiG/dI7uStM69z3Tkl48m0y+n0nunUGNKF8xeuIz5vc3zYpDpggK EjqiI1ACeHDvp6R1HndGYKNyW/j95UKfcxnVdhGePiJ3DVuwtfxL+G4oZuzAOej9dKr5 ACkeRCQ4jTIgHUB7JJKTNebHokWKD189MFVyXTtFepepUMxQibmrp0QA2MOFHD+LFb6+ S6MYcGDNb/LFx0Z9iCogtLSA4nOhZvZdNez050msE3TyULCXLZYR/McareLO3CSkOfUV w1IQ== X-Mailman-Original-Authentication-Results: smtp2.osuosl.org; dmarc=pass (p=none dis=none) header.from=gmail.com X-Mailman-Original-Authentication-Results: smtp2.osuosl.org; dkim=pass (2048-bit key, unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20230601 header.b=cib9xdMj Subject: [Intel-wired-lan] [PATCH net v4 1/1] i40e: xsk: advance next_to_clean on status descriptors X-BeenThere: intel-wired-lan@osuosl.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Intel Wired Ethernet Linux Kernel Driver Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: intel-wired-lan-bounces@osuosl.org Sender: "Intel-wired-lan" Whenever a status descriptor is received, i40e processes and skips over it, correctly updating next_to_process but forgetting to update next_to_clean. In the next iteration this accidentally causes the creation of an invalid multi-buffer xdp_buff where the first fragment is the status descriptor. If then a skb is constructed from such an invalid buffer - because the eBPF program returns XDP_PASS - a panic occurs: [ 5866.367317] BUG: unable to handle page fault for address: ffd31c37eab1c980 [ 5866.375050] #PF: supervisor read access in kernel mode [ 5866.380825] #PF: error_code(0x0000) - not-present page [ 5866.386602] PGD 0 [ 5866.388867] Oops: Oops: 0000 [#1] SMP NOPTI [ 5866.393575] CPU: 34 UID: 0 PID: 0 Comm: swapper/34 Not tainted 6.17.0-custom #1 PREEMPT(voluntary) [ 5866.403740] Hardware name: Supermicro AS -2115GT-HNTR/H13SST-G, BIOS 3.2 03/20/2025 [ 5866.412339] RIP: 0010:memcpy+0x8/0x10 [ 5866.416454] Code: cc cc 90 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 90 48 89 f8 48 89 d1 a4 e9 fc 26 c0 fe 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 5866.437538] RSP: 0018:ff428d9ec0bb0ca8 EFLAGS: 00010286 [ 5866.443415] RAX: ff2dd26dbd8f0000 RBX: ff2dd265ad161400 RCX: 00000000000004e1 [ 5866.451435] RDX: 00000000000004e1 RSI: ffd31c37eab1c980 RDI: ff2dd26dbd8f0000 [ 5866.459454] RBP: ff428d9ec0bb0d40 R08: 0000000000000000 R09: 0000000000000000 [ 5866.467470] R10: 0000000000000000 R11: 0000000000000000 R12: ff428d9eec726ef8 [ 5866.475490] R13: ff2dd26dbd8f0000 R14: ff2dd265ca2f9fc0 R15: ff2dd26548548b80 [ 5866.483509] FS: 0000000000000000(0000) GS:ff2dd2c363592000(0000) knlGS:0000000000000000 [ 5866.492600] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 5866.499060] CR2: ffd31c37eab1c980 CR3: 0000000178d7b040 CR4: 0000000000f71ef0 [ 5866.507079] PKRU: 55555554 [ 5866.510125] Call Trace: [ 5866.512867] [ 5866.515132] ? i40e_clean_rx_irq_zc+0xc50/0xe60 [i40e] [ 5866.520921] i40e_napi_poll+0x2d8/0x1890 [i40e] [ 5866.526022] ? srso_alias_return_thunk+0x5/0xfbef5 [ 5866.531408] ? raise_softirq+0x24/0x70 [ 5866.535623] ? srso_alias_return_thunk+0x5/0xfbef5 [ 5866.541011] ? srso_alias_return_thunk+0x5/0xfbef5 [ 5866.546397] ? rcu_sched_clock_irq+0x225/0x1800 [ 5866.551493] __napi_poll+0x30/0x230 [ 5866.555423] net_rx_action+0x20b/0x3f0 [ 5866.559643] handle_softirqs+0xe4/0x340 [ 5866.563962] __irq_exit_rcu+0x10e/0x130 [ 5866.568283] irq_exit_rcu+0xe/0x20 [ 5866.572110] common_interrupt+0xb6/0xe0 [ 5866.576425] [ 5866.578791] Advance next_to_clean to ensure invalid xdp_buff(s) aren't created. Move the common logic to i40e_clean_programming_status and update both i40e_clean_rx_irq and i40e_clean_rx_irq_zc accordingly. Fixes: 1c9ba9c14658 ("i40e: xsk: add RX multi-buffer support") Signed-off-by: Alessandro Decina --- drivers/net/ethernet/intel/i40e/i40e_txrx.c | 59 +++++++++++-------- .../ethernet/intel/i40e/i40e_txrx_common.h | 5 +- drivers/net/ethernet/intel/i40e/i40e_xsk.c | 14 ++--- 3 files changed, 42 insertions(+), 36 deletions(-) diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c index cc0b9efc2637..fe2190f4b9bc 100644 --- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c +++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c @@ -1386,22 +1386,36 @@ static void i40e_reuse_rx_page(struct i40e_ring *rx_ring, * @rx_ring: the rx ring that has this descriptor * @qword0_raw: qword0 * @qword1: qword1 representing status_error_len in CPU ordering + * @next_to_process: pointer to next_to_process index + * @next_to_clean: pointer to next_to_clean index * * Flow director should handle FD_FILTER_STATUS to check its filter programming * status being successful or not and take actions accordingly. FCoE should * handle its context/filter programming/invalidation status and take actions. * - * Returns an i40e_rx_buffer to reuse if the cleanup occurred, otherwise NULL. + * Returns false if what is passed is not a status descriptor. **/ -void i40e_clean_programming_status(struct i40e_ring *rx_ring, u64 qword0_raw, - u64 qword1) +bool i40e_clean_programming_status(struct i40e_ring *rx_ring, u64 qword0_raw, + u64 qword1, u16 *next_to_process, + u16 *next_to_clean) { + u16 ntp = *next_to_process; u8 id; + if (!i40e_rx_is_programming_status(qword1)) + return false; + id = FIELD_GET(I40E_RX_PROG_STATUS_DESC_QW1_PROGID_MASK, qword1); if (id == I40E_RX_PROG_STATUS_DESC_FD_FILTER_STATUS) i40e_fd_handle_status(rx_ring, qword0_raw, qword1, id); + + if (++*next_to_process == rx_ring->count) + *next_to_process = 0; + if (ntp == *next_to_clean) + *next_to_clean = *next_to_process; + + return true; } /** @@ -1971,19 +1985,18 @@ static void i40e_rx_buffer_flip(struct i40e_rx_buffer *rx_buffer, } /** - * i40e_get_rx_buffer - Fetch Rx buffer and synchronize data for use + * i40e_prepare_rx_buffer - Synchronize the buffer for use by the CPU * @rx_ring: rx descriptor ring to transact packets on + * @rx_buffer: the rx buffer * @size: size of buffer to add to skb * - * This function will pull an Rx buffer from the ring and synchronize it - * for use by the CPU. + * This function will synchronize the given buffer for use by the CPU. */ -static struct i40e_rx_buffer *i40e_get_rx_buffer(struct i40e_ring *rx_ring, - const unsigned int size) +static struct i40e_rx_buffer * +i40e_prepare_rx_buffer(struct i40e_ring *rx_ring, + struct i40e_rx_buffer *rx_buffer, + const unsigned int size) { - struct i40e_rx_buffer *rx_buffer; - - rx_buffer = i40e_rx_bi(rx_ring, rx_ring->next_to_process); rx_buffer->page_count = #if (PAGE_SIZE < 8192) page_count(rx_buffer->page); @@ -2450,6 +2463,7 @@ static int i40e_clean_rx_irq(struct i40e_ring *rx_ring, int budget, while (likely(total_rx_packets < (unsigned int)budget)) { u16 ntp = rx_ring->next_to_process; + u16 ntc = rx_ring->next_to_clean; struct i40e_rx_buffer *rx_buffer; union i40e_rx_desc *rx_desc; struct sk_buff *skb; @@ -2480,21 +2494,15 @@ static int i40e_clean_rx_irq(struct i40e_ring *rx_ring, int budget, */ dma_rmb(); - if (i40e_rx_is_programming_status(qword)) { - i40e_clean_programming_status(rx_ring, - rx_desc->raw.qword[0], - qword); - rx_buffer = i40e_rx_bi(rx_ring, ntp); - i40e_inc_ntp(rx_ring); + rx_buffer = i40e_rx_bi(rx_ring, ntp); + + if (i40e_clean_programming_status(rx_ring, + rx_desc->raw.qword[0], qword, + &rx_ring->next_to_process, + &rx_ring->next_to_clean)) { i40e_reuse_rx_page(rx_ring, rx_buffer); - /* Update ntc and bump cleaned count if not in the - * middle of mb packet. - */ - if (rx_ring->next_to_clean == ntp) { - rx_ring->next_to_clean = - rx_ring->next_to_process; + if (ntc != rx_ring->next_to_clean) cleaned_count++; - } continue; } @@ -2503,8 +2511,7 @@ static int i40e_clean_rx_irq(struct i40e_ring *rx_ring, int budget, break; i40e_trace(clean_rx_irq, rx_ring, rx_desc, xdp); - /* retrieve a buffer from the ring */ - rx_buffer = i40e_get_rx_buffer(rx_ring, size); + i40e_prepare_rx_buffer(rx_ring, rx_buffer, size); neop = i40e_is_non_eop(rx_ring, rx_desc); i40e_inc_ntp(rx_ring); diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx_common.h b/drivers/net/ethernet/intel/i40e/i40e_txrx_common.h index e26807fd2123..21d9ed878bf0 100644 --- a/drivers/net/ethernet/intel/i40e/i40e_txrx_common.h +++ b/drivers/net/ethernet/intel/i40e/i40e_txrx_common.h @@ -7,8 +7,9 @@ #include "i40e.h" int i40e_xmit_xdp_tx_ring(struct xdp_buff *xdp, struct i40e_ring *xdp_ring); -void i40e_clean_programming_status(struct i40e_ring *rx_ring, u64 qword0_raw, - u64 qword1); +bool i40e_clean_programming_status(struct i40e_ring *rx_ring, u64 qword0_raw, + u64 qword1, u16 *next_to_clean, + u16 *next_to_process); void i40e_process_skb_fields(struct i40e_ring *rx_ring, union i40e_rx_desc *rx_desc, struct sk_buff *skb); void i40e_xdp_ring_update_tail(struct i40e_ring *xdp_ring); diff --git a/drivers/net/ethernet/intel/i40e/i40e_xsk.c b/drivers/net/ethernet/intel/i40e/i40e_xsk.c index 9f47388eaba5..f8accc266c2c 100644 --- a/drivers/net/ethernet/intel/i40e/i40e_xsk.c +++ b/drivers/net/ethernet/intel/i40e/i40e_xsk.c @@ -440,14 +440,13 @@ int i40e_clean_rx_irq_zc(struct i40e_ring *rx_ring, int budget) */ dma_rmb(); - if (i40e_rx_is_programming_status(qword)) { - i40e_clean_programming_status(rx_ring, - rx_desc->raw.qword[0], - qword); - bi = *i40e_rx_bi(rx_ring, next_to_process); + bi = *i40e_rx_bi(rx_ring, next_to_process); + + if (i40e_clean_programming_status(rx_ring, + rx_desc->raw.qword[0], + qword, &next_to_process, + &next_to_clean)) { xsk_buff_free(bi); - if (++next_to_process == count) - next_to_process = 0; continue; } @@ -455,7 +454,6 @@ int i40e_clean_rx_irq_zc(struct i40e_ring *rx_ring, int budget) if (!size) break; - bi = *i40e_rx_bi(rx_ring, next_to_process); xsk_buff_set_size(bi, size); xsk_buff_dma_sync_for_cpu(bi); -- 2.43.0