[PATCH net 1/2] net: stmmac: fix rx budget limit check

[PATCH net 1/2] net: stmmac: fix rx budget limit check

[Baruch Siach]

The while loop condition verifies 'count < limit'. Neither value change
before the 'count >= limit' check. As is this check is dead code. But
code inspection reveals a code path that modifies 'count' and then goto
'drain_data' and back to 'read_again'. So there is a need to verify
count value sanity after 'read_again'.

Move 'read_again' up to fix the count limit check.

Fixes: ec222003bd94 ("net: stmmac: Prepare to add Split Header support")
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
---
 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 3e50fd53a617..f28838c8cdb3 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -5328,10 +5328,10 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
 			len = 0;
 		}
 
+read_again:
 		if (count >= limit)
 			break;
 
-read_again:
 		buf1_len = 0;
 		buf2_len = 0;
 		entry = next_entry;
-- 
2.42.0

[PATCH net 2/2] net: stmmac: avoid rx queue overrun

[Baruch Siach]

dma_rx_size can be set as low as 64. Rx budget might be higher than
that. Make sure to not overrun allocated rx buffers when budget is
larger.

Leave one descriptor unused to avoid wrap around of 'dirty_rx' vs
'cur_rx'.

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
---
 drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index f28838c8cdb3..2afb2bd25977 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -5293,6 +5293,7 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
 
 	dma_dir = page_pool_get_dma_dir(rx_q->page_pool);
 	buf_sz = DIV_ROUND_UP(priv->dma_conf.dma_buf_sz, PAGE_SIZE) * PAGE_SIZE;
+	limit = min(priv->dma_conf.dma_rx_size - 1, (unsigned int)limit);
 
 	if (netif_msg_rx_status(priv)) {
 		void *rx_head;
-- 
2.42.0

Re: [PATCH net 2/2] net: stmmac: avoid rx queue overrun

[Jakub Kicinski]

On Mon, 13 Nov 2023 19:42:50 +0200 Baruch Siach wrote:
> dma_rx_size can be set as low as 64. Rx budget might be higher than
> that. Make sure to not overrun allocated rx buffers when budget is
> larger.
> 
> Leave one descriptor unused to avoid wrap around of 'dirty_rx' vs
> 'cur_rx'.

Can we get a Fixes tag for this one as well?

Re: [PATCH net 2/2] net: stmmac: avoid rx queue overrun

[Baruch Siach]

Hi Jakub,

On Mon, Nov 13 2023, Jakub Kicinski wrote:
> On Mon, 13 Nov 2023 19:42:50 +0200 Baruch Siach wrote:
>> dma_rx_size can be set as low as 64. Rx budget might be higher than
>> that. Make sure to not overrun allocated rx buffers when budget is
>> larger.
>> 
>> Leave one descriptor unused to avoid wrap around of 'dirty_rx' vs
>> 'cur_rx'.
>
> Can we get a Fixes tag for this one as well?

I believe it goes back to the commit that introduced the driver.

Fixes: 47dd7a540b8a ("net: add support for STMicroelectronics Ethernet controllers.")

Should I resend with the Fixes tag?

baruch

-- 
                                                     ~. .~   Tk Open Systems
=}------------------------------------------------ooO--U--Ooo------------{=
   - baruch@tkos.co.il - tel: +972.52.368.4656, http://www.tkos.co.il -

Re: [PATCH net 1/2] net: stmmac: fix rx budget limit check

[Serge Semin]

On Mon, Nov 13, 2023 at 07:42:49PM +0200, Baruch Siach wrote:
> The while loop condition verifies 'count < limit'. Neither value change
> before the 'count >= limit' check. As is this check is dead code. But
> code inspection reveals a code path that modifies 'count' and then goto
> 'drain_data' and back to 'read_again'. So there is a need to verify
> count value sanity after 'read_again'.
> 
> Move 'read_again' up to fix the count limit check.

Nice catch! My local fix was to just drop the statement, but obviously
it was wrong. Indeed it's possible to have an implicit loop based on
two goto'es. So for this change definitely:
Reviewed-by: Serge Semin <fancer.lancer@gmail.com>

From the patch perspective seeing how clumsy the
stmmac_rx()/stmmac_xmit() methods look here and in several/multiple
other net-drivers here is a question to the subsystem maintainers. Is
it really a preferred practice to design them that way with gotos and
embed all the various stuff directly to a single function? Wouldn't it
be better at least from the readability point of view to split them up
into a set of smaller coherent functions and get rid from the gotos?

I am wondering because normally it would be indeed better, but network
subsystem may have some special requirements for such methods (if so
is it described anywhere in the kernel doc?), for instance, to reach a
greater performance by not relying on the compiler to embed the
sub-functions body into the denoted functions or by using the gotos so
not to increment the loop-counter and preserve the indentation level.
All of that may improve the code performance in some extent, but in
its turn it significantly reduces the code readability and
maintainability.

-Serge(y)

> 
> Fixes: ec222003bd94 ("net: stmmac: Prepare to add Split Header support")
> Signed-off-by: Baruch Siach <baruch@tkos.co.il>
> ---
>  drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
> index 3e50fd53a617..f28838c8cdb3 100644
> --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
> +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
> @@ -5328,10 +5328,10 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
>  			len = 0;
>  		}
>  
> +read_again:
>  		if (count >= limit)
>  			break;
>  
> -read_again:
>  		buf1_len = 0;
>  		buf2_len = 0;
>  		entry = next_entry;
> -- 
> 2.42.0
> 
> 

Re: [PATCH net 2/2] net: stmmac: avoid rx queue overrun

[Serge Semin]

On Mon, Nov 13, 2023 at 07:42:50PM +0200, Baruch Siach wrote:
> dma_rx_size can be set as low as 64. Rx budget might be higher than
> that. Make sure to not overrun allocated rx buffers when budget is
> larger.
> 
> Leave one descriptor unused to avoid wrap around of 'dirty_rx' vs
> 'cur_rx'.

Have you ever met the denoted problem? I am asking because what you
say can happen only if the incoming traffic overruns the Rx-buffer,
otherwise the loop will break on the first found DMA-own descriptor.
But if that happens AFAICS the result will likely to be fatal because
the stmmac_rx() method will try to handle the already handled and not
yet recycled descriptor with no buffers assigned.

So after adding the Fixes tag feel tree to add:
Reviewed-by: Serge Semin <fancer.lancer@gmail.com>

-Serge(y)

> 
> Signed-off-by: Baruch Siach <baruch@tkos.co.il>
> ---
>  drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
> index f28838c8cdb3..2afb2bd25977 100644
> --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
> +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
> @@ -5293,6 +5293,7 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
>  
>  	dma_dir = page_pool_get_dma_dir(rx_q->page_pool);
>  	buf_sz = DIV_ROUND_UP(priv->dma_conf.dma_buf_sz, PAGE_SIZE) * PAGE_SIZE;
> +	limit = min(priv->dma_conf.dma_rx_size - 1, (unsigned int)limit);
>  
>  	if (netif_msg_rx_status(priv)) {
>  		void *rx_head;
> -- 
> 2.42.0
> 
> 

Re: [PATCH net 2/2] net: stmmac: avoid rx queue overrun

[Baruch Siach]

Hi Serge,

On Tue, Nov 14 2023, Serge Semin wrote:
> On Mon, Nov 13, 2023 at 07:42:50PM +0200, Baruch Siach wrote:
>> dma_rx_size can be set as low as 64. Rx budget might be higher than
>> that. Make sure to not overrun allocated rx buffers when budget is
>> larger.
>> 
>> Leave one descriptor unused to avoid wrap around of 'dirty_rx' vs
>> 'cur_rx'.
>
> Have you ever met the denoted problem? I am asking because what you
> say can happen only if the incoming traffic overruns the Rx-buffer,
> otherwise the loop will break on the first found DMA-own descriptor.
> But if that happens AFAICS the result will likely to be fatal because
> the stmmac_rx() method will try to handle the already handled and not
> yet recycled descriptor with no buffers assigned.

I have encountered this issue. When stmmac_rx() consumes all dma_rx_size
descriptors in one go, dirty_rx == cur_rx, which leads stmmac_rx_dirty()
to return zero. That in turn makes stmmac_rx_refill() skip
stmmac_set_rx_owner() so that Rx hangs completely.

> So after adding the Fixes tag feel tree to add:
> Reviewed-by: Serge Semin <fancer.lancer@gmail.com>

Thanks,
baruch

> -Serge(y)
>
>> 
>> Signed-off-by: Baruch Siach <baruch@tkos.co.il>
>> ---
>>  drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 1 +
>>  1 file changed, 1 insertion(+)
>> 
>> diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
>> index f28838c8cdb3..2afb2bd25977 100644
>> --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
>> +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
>> @@ -5293,6 +5293,7 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
>>  
>>  	dma_dir = page_pool_get_dma_dir(rx_q->page_pool);
>>  	buf_sz = DIV_ROUND_UP(priv->dma_conf.dma_buf_sz, PAGE_SIZE) * PAGE_SIZE;
>> +	limit = min(priv->dma_conf.dma_rx_size - 1, (unsigned int)limit);
>>  
>>  	if (netif_msg_rx_status(priv)) {
>>  		void *rx_head;
>> -- 
>> 2.42.0
>> 
>> 


-- 
                                                     ~. .~   Tk Open Systems
=}------------------------------------------------ooO--U--Ooo------------{=
   - baruch@tkos.co.il - tel: +972.52.368.4656, http://www.tkos.co.il -

Re: [PATCH net 1/2] net: stmmac: fix rx budget limit check

[patchwork-bot+netdevbpf]

Hello:

This series was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Mon, 13 Nov 2023 19:42:49 +0200 you wrote:
> The while loop condition verifies 'count < limit'. Neither value change
> before the 'count >= limit' check. As is this check is dead code. But
> code inspection reveals a code path that modifies 'count' and then goto
> 'drain_data' and back to 'read_again'. So there is a need to verify
> count value sanity after 'read_again'.
> 
> Move 'read_again' up to fix the count limit check.
> 
> [...]

Here is the summary with links:
  - [net,1/2] net: stmmac: fix rx budget limit check
    https://git.kernel.org/netdev/net/c/fa02de9e7588
  - [net,2/2] net: stmmac: avoid rx queue overrun
    https://git.kernel.org/netdev/net/c/b6cb4541853c

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html