[PATCH net 0/2] sfc: more ARFS fixes

[PATCH net 0/2] sfc: more ARFS fixes

[Edward Cree]

A couple more bits of breakage in my recent ARFS and async filters work.
Patch #1 in particular fixes a bug that leads to memory trampling and
 consequent crashes.

Edward Cree (2):
  sfc: Use filter index rather than ID for rps_flow_id table
  sfc: fix ARFS expiry check on EF10

 drivers/net/ethernet/sfc/ef10.c | 5 +++--
 drivers/net/ethernet/sfc/rx.c   | 2 ++
 2 files changed, 5 insertions(+), 2 deletions(-)

[PATCH net 1/2] sfc: Use filter index rather than ID for rps_flow_id table

[Edward Cree]

efx->type->filter_insert() returns an ID rather than the index that
 efx->type->filter_async_insert() used to, which causes it to exceed
 efx->type->max_rx_ip_filters on some EF10 configurations, leading to out-
 of-bounds array writes.
So, in efx_filter_rfs_work(), convert this back into an index (which is
 what the remove call in the expiry path expects, anyway).

Fixes: 3af0f34290f6 ("sfc: replace asynchronous filter operations")
Signed-off-by: Edward Cree <ecree@solarflare.com>
---
 drivers/net/ethernet/sfc/rx.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/ethernet/sfc/rx.c b/drivers/net/ethernet/sfc/rx.c
index 64a94f242027..d2e254f2f72b 100644
--- a/drivers/net/ethernet/sfc/rx.c
+++ b/drivers/net/ethernet/sfc/rx.c
@@ -839,6 +839,8 @@ static void efx_filter_rfs_work(struct work_struct *data)
 	int rc;
 
 	rc = efx->type->filter_insert(efx, &req->spec, true);
+	if (rc >= 0)
+		rc %= efx->type->max_rx_ip_filters;
 	if (efx->rps_hash_table) {
 		spin_lock_bh(&efx->rps_hash_lock);
 		rule = efx_rps_hash_find(efx, &req->spec);

[PATCH net 2/2] sfc: fix ARFS expiry check on EF10

[Edward Cree]

Owing to a missing conditional, the result of rps_may_expire_flow() was
 being ignored and filters were being removed even if we'd decided not to
 expire them.

Fixes: f8d6203780b7 ("sfc: ARFS filter IDs")
Signed-off-by: Edward Cree <ecree@solarflare.com>
---
 drivers/net/ethernet/sfc/ef10.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c
index 63036d9bf3e6..d90a7b1f4088 100644
--- a/drivers/net/ethernet/sfc/ef10.c
+++ b/drivers/net/ethernet/sfc/ef10.c
@@ -4784,8 +4784,9 @@ static bool efx_ef10_filter_rfs_expire_one(struct efx_nic *efx, u32 flow_id,
 	 * will set rule->filter_id to EFX_ARFS_FILTER_ID_PENDING, meaning that
 	 * the rule is not removed by efx_rps_hash_del() below.
 	 */
-	ret = efx_ef10_filter_remove_internal(efx, 1U << spec->priority,
-					      filter_idx, true) == 0;
+	if (ret)
+		ret = efx_ef10_filter_remove_internal(efx, 1U << spec->priority,
+						      filter_idx, true) == 0;
 	/* While we can't safely dereference rule (we dropped the lock), we can
 	 * still test it for NULL.
 	 */

Re: [PATCH net 0/2] sfc: more ARFS fixes

[David Miller]

From: Edward Cree <ecree@solarflare.com>
Date: Fri, 27 Apr 2018 15:07:19 +0100

> A couple more bits of breakage in my recent ARFS and async filters work.
> Patch #1 in particular fixes a bug that leads to memory trampling and
>  consequent crashes.

Series applied, thanks Edward.