From: Simon Horman <horms@kernel.org>
To: Marcin Szycik <marcin.szycik@linux.intel.com>
Cc: intel-wired-lan@lists.osuosl.org, netdev@vger.kernel.org,
przemyslaw.kitszel@intel.com,
Jacob Keller <jacob.e.keller@intel.com>,
Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
Subject: Re: [PATCH iwl-net] ice: Fix increasing MSI-X on VF
Date: Mon, 30 Sep 2024 15:51:41 +0100 [thread overview]
Message-ID: <20240930145141.GA1310185@kernel.org> (raw)
In-Reply-To: <20240927151541.15704-1-marcin.szycik@linux.intel.com>
On Fri, Sep 27, 2024 at 05:15:40PM +0200, Marcin Szycik wrote:
> Increasing MSI-X value on a VF leads to invalid memory operations. This
> is caused by not reallocating some arrays.
>
> Reproducer:
> modprobe ice
> echo 0 > /sys/bus/pci/devices/$PF_PCI/sriov_drivers_autoprobe
> echo 1 > /sys/bus/pci/devices/$PF_PCI/sriov_numvfs
> echo 17 > /sys/bus/pci/devices/$VF0_PCI/sriov_vf_msix_count
>
> Default MSI-X is 16, so 17 and above triggers this issue.
>
> KASAN reports:
>
> BUG: KASAN: slab-out-of-bounds in ice_vsi_alloc_ring_stats+0x38d/0x4b0 [ice]
> Read of size 8 at addr ffff8888b937d180 by task bash/28433
> (...)
>
> Call Trace:
> (...)
> ? ice_vsi_alloc_ring_stats+0x38d/0x4b0 [ice]
> kasan_report+0xed/0x120
> ? ice_vsi_alloc_ring_stats+0x38d/0x4b0 [ice]
> ice_vsi_alloc_ring_stats+0x38d/0x4b0 [ice]
> ice_vsi_cfg_def+0x3360/0x4770 [ice]
> ? mutex_unlock+0x83/0xd0
> ? __pfx_ice_vsi_cfg_def+0x10/0x10 [ice]
> ? __pfx_ice_remove_vsi_lkup_fltr+0x10/0x10 [ice]
> ice_vsi_cfg+0x7f/0x3b0 [ice]
> ice_vf_reconfig_vsi+0x114/0x210 [ice]
> ice_sriov_set_msix_vec_count+0x3d0/0x960 [ice]
> sriov_vf_msix_count_store+0x21c/0x300
> (...)
>
> Allocated by task 28201:
> (...)
> ice_vsi_cfg_def+0x1c8e/0x4770 [ice]
> ice_vsi_cfg+0x7f/0x3b0 [ice]
> ice_vsi_setup+0x179/0xa30 [ice]
> ice_sriov_configure+0xcaa/0x1520 [ice]
> sriov_numvfs_store+0x212/0x390
> (...)
>
> To fix it, use ice_vsi_rebuild() instead of ice_vf_reconfig_vsi(). This
> causes the required arrays to be reallocated taking the new queue count
> into account (ice_vsi_realloc_stat_arrays()). Set req_txq and req_rxq
> before ice_vsi_rebuild(), so that realloc uses the newly set queue
> count.
>
> Additionally, ice_vsi_rebuild() does not remove VSI filters
> (ice_fltr_remove_all()), so ice_vf_init_host_cfg() is no longer
> necessary.
>
> Reported-by: Jacob Keller <jacob.e.keller@intel.com>
> Fixes: 2a2cb4c6c181 ("ice: replace ice_vf_recreate_vsi() with ice_vf_reconfig_vsi()")
> Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
> Signed-off-by: Marcin Szycik <marcin.szycik@linux.intel.com>
Reviewed-by: Simon Horman <horms@kernel.org>
next prev parent reply other threads:[~2024-09-30 14:51 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-09-27 15:15 [PATCH iwl-net] ice: Fix increasing MSI-X on VF Marcin Szycik
2024-09-30 14:51 ` Simon Horman [this message]
2024-10-03 12:07 ` [Intel-wired-lan] " Romanowski, Rafal
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240930145141.GA1310185@kernel.org \
--to=horms@kernel.org \
--cc=intel-wired-lan@lists.osuosl.org \
--cc=jacob.e.keller@intel.com \
--cc=marcin.szycik@linux.intel.com \
--cc=michal.swiatkowski@linux.intel.com \
--cc=netdev@vger.kernel.org \
--cc=przemyslaw.kitszel@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).