From: Jiangfeng Xiao <xiaojiangfeng@huawei.com>
To: Jakub Kicinski <jakub.kicinski@netronome.com>
Cc: <davem@davemloft.net>, <yisen.zhuang@huawei.com>,
<salil.mehta@huawei.com>, <netdev@vger.kernel.org>,
<linux-kernel@vger.kernel.org>, <leeyou.li@huawei.com>,
<xiaowei774@huawei.com>, <nixiaoming@huawei.com>
Subject: Re: [PATCH v1 1/3] net: hisilicon: make hip04_tx_reclaim non-reentrant
Date: Tue, 6 Aug 2019 10:00:52 +0800 [thread overview]
Message-ID: <c150d41b-6f0e-ad49-e8c2-00896fc9cbe4@huawei.com> (raw)
In-Reply-To: <20190805174618.2b3b551a@cakuba.netronome.com>
On 2019/8/6 8:46, Jakub Kicinski wrote:
> On Sat, 3 Aug 2019 20:31:39 +0800, Jiangfeng Xiao wrote:
>> If hip04_tx_reclaim is interrupted while it is running
>> and then __napi_schedule continues to execute
>> hip04_rx_poll->hip04_tx_reclaim, reentrancy occurs
>> and oops is generated. So you need to mask the interrupt
>> during the hip04_tx_reclaim run.
>
> Napi poll method for the same napi instance can't be run concurrently.
> Could you explain a little more what happens here?
>
Because netif_napi_add(ndev, &priv->napi, hip04_rx_poll, NAPI_POLL_WEIGHT);
So hip04_rx_poll is a napi instance.
I did not say that hip04_rx_poll has reentered.
I am talking about the reentrant of hip04_tx_reclaim.
Pre-modification code:
static int hip04_rx_poll(struct napi_struct *napi, int budget)
{
[...]
/* enable rx interrupt */
writel_relaxed(priv->reg_inten, priv->base + PPE_INTEN);
napi_complete_done(napi, rx);
done:
/* clean up tx descriptors and start a new timer if necessary */
tx_remaining = hip04_tx_reclaim(ndev, false);
[...]
}
hip04_tx_reclaim is executed after "enable rx interrupt" and napi_complete_done.
If hip04_tx_reclaim is interrupted while it is running, and then
__irq_svc->gic_handle_irq->hip04_mac_interrupt->__napi_schedule->hip04_rx_poll->hip04_tx_reclaim
Also looking at hip04_tx_reclaim
static int hip04_tx_reclaim(struct net_device *ndev, bool force)
{
[1] struct hip04_priv *priv = netdev_priv(ndev);
[2] unsigned tx_tail = priv->tx_tail;
[3] [...]
[4] bytes_compl += priv->tx_skb[tx_tail]->len;
[5] dev_kfree_skb(priv->tx_skb[tx_tail]);
[6] priv->tx_skb[tx_tail] = NULL;
[7] tx_tail = TX_NEXT(tx_tail);
[8] [...]
[9] priv->tx_tail = tx_tail;
}
An interrupt occurs if hip04_tx_reclaim just executes to the line 6,
priv->tx_skb[tx_tail] is NULL, and then
__irq_svc->gic_handle_irq->hip04_mac_interrupt->__napi_schedule->hip04_rx_poll->hip04_tx_reclaim
Then hip04_tx_reclaim will handle kernel NULL pointer dereference on line 4.
A reentrant occurs in hip04_tx_reclaim and oops is generated.
My commit is to execute hip04_tx_reclaim before "enable rx interrupt" and napi_complete_done.
Then hip04_tx_reclaim can also be protected by the napi poll method so that no reentry occurs.
thanks.
next prev parent reply other threads:[~2019-08-06 2:01 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-08-03 12:31 [PATCH v1 0/3] net: hisilicon: Fix a few problems with hip04_eth Jiangfeng Xiao
2019-08-03 12:31 ` [PATCH v1 1/3] net: hisilicon: make hip04_tx_reclaim non-reentrant Jiangfeng Xiao
2019-08-06 0:46 ` Jakub Kicinski
2019-08-06 2:00 ` Jiangfeng Xiao [this message]
2019-08-06 3:05 ` Jakub Kicinski
2019-08-03 12:31 ` [PATCH v1 2/3] net: hisilicon: fix hip04-xmit never return TX_BUSY Jiangfeng Xiao
2019-08-03 12:31 ` [PATCH v1 3/3] net: hisilicon: Fix dma_map_single failed on arm64 Jiangfeng Xiao
2019-08-06 21:15 ` [PATCH v1 0/3] net: hisilicon: Fix a few problems with hip04_eth David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=c150d41b-6f0e-ad49-e8c2-00896fc9cbe4@huawei.com \
--to=xiaojiangfeng@huawei.com \
--cc=davem@davemloft.net \
--cc=jakub.kicinski@netronome.com \
--cc=leeyou.li@huawei.com \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=nixiaoming@huawei.com \
--cc=salil.mehta@huawei.com \
--cc=xiaowei774@huawei.com \
--cc=yisen.zhuang@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).