net: embed nr_ids in the xps maps
Embed nr_ids (the number of cpu for the xps cpus map, and the number of rxqs for the xps cpus map) in dev_maps. That will help not accessing out of bound memory if those values change after dev_maps was allocated. Suggested-by: Alexander Duyck <alexander.duyck@gmail.com> Signed-off-by: Antoine Tenart <atenart@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
		
							parent
							
								
									255c04a87f
								
							
						
					
					
						commit
						5478fcd0f4
					
				| @ -772,6 +772,9 @@ struct xps_map { | |||||||
| /*
 | /*
 | ||||||
|  * This structure holds all XPS maps for device.  Maps are indexed by CPU. |  * This structure holds all XPS maps for device.  Maps are indexed by CPU. | ||||||
|  * |  * | ||||||
|  |  * We keep track of the number of cpus/rxqs used when the struct is allocated, | ||||||
|  |  * in nr_ids. This will help not accessing out-of-bound memory. | ||||||
|  |  * | ||||||
|  * We keep track of the number of traffic classes used when the struct is |  * We keep track of the number of traffic classes used when the struct is | ||||||
|  * allocated, in num_tc. This will be used to navigate the maps, to ensure we're |  * allocated, in num_tc. This will be used to navigate the maps, to ensure we're | ||||||
|  * not crossing its upper bound, as the original dev->num_tc can be updated in |  * not crossing its upper bound, as the original dev->num_tc can be updated in | ||||||
| @ -779,6 +782,7 @@ struct xps_map { | |||||||
|  */ |  */ | ||||||
| struct xps_dev_maps { | struct xps_dev_maps { | ||||||
| 	struct rcu_head rcu; | 	struct rcu_head rcu; | ||||||
|  | 	unsigned int nr_ids; | ||||||
| 	s16 num_tc; | 	s16 num_tc; | ||||||
| 	struct xps_map __rcu *attr_map[]; /* Either CPUs map or RXQs map */ | 	struct xps_map __rcu *attr_map[]; /* Either CPUs map or RXQs map */ | ||||||
| }; | }; | ||||||
|  | |||||||
| @ -2524,14 +2524,14 @@ static void reset_xps_maps(struct net_device *dev, | |||||||
| } | } | ||||||
| 
 | 
 | ||||||
| static void clean_xps_maps(struct net_device *dev, const unsigned long *mask, | static void clean_xps_maps(struct net_device *dev, const unsigned long *mask, | ||||||
| 			   struct xps_dev_maps *dev_maps, unsigned int nr_ids, | 			   struct xps_dev_maps *dev_maps, u16 offset, u16 count, | ||||||
| 			   u16 offset, u16 count, bool is_rxqs_map) | 			   bool is_rxqs_map) | ||||||
| { | { | ||||||
|  | 	unsigned int nr_ids = dev_maps->nr_ids; | ||||||
| 	bool active = false; | 	bool active = false; | ||||||
| 	int i, j; | 	int i, j; | ||||||
| 
 | 
 | ||||||
| 	for (j = -1; j = netif_attrmask_next(j, mask, nr_ids), | 	for (j = -1; j = netif_attrmask_next(j, mask, nr_ids), j < nr_ids;) | ||||||
| 	     j < nr_ids;) |  | ||||||
| 		active |= remove_xps_queue_cpu(dev, dev_maps, j, offset, | 		active |= remove_xps_queue_cpu(dev, dev_maps, j, offset, | ||||||
| 					       count); | 					       count); | ||||||
| 	if (!active) | 	if (!active) | ||||||
| @ -2551,7 +2551,6 @@ static void netif_reset_xps_queues(struct net_device *dev, u16 offset, | |||||||
| { | { | ||||||
| 	const unsigned long *possible_mask = NULL; | 	const unsigned long *possible_mask = NULL; | ||||||
| 	struct xps_dev_maps *dev_maps; | 	struct xps_dev_maps *dev_maps; | ||||||
| 	unsigned int nr_ids; |  | ||||||
| 
 | 
 | ||||||
| 	if (!static_key_false(&xps_needed)) | 	if (!static_key_false(&xps_needed)) | ||||||
| 		return; | 		return; | ||||||
| @ -2561,11 +2560,9 @@ static void netif_reset_xps_queues(struct net_device *dev, u16 offset, | |||||||
| 
 | 
 | ||||||
| 	if (static_key_false(&xps_rxqs_needed)) { | 	if (static_key_false(&xps_rxqs_needed)) { | ||||||
| 		dev_maps = xmap_dereference(dev->xps_rxqs_map); | 		dev_maps = xmap_dereference(dev->xps_rxqs_map); | ||||||
| 		if (dev_maps) { | 		if (dev_maps) | ||||||
| 			nr_ids = dev->num_rx_queues; | 			clean_xps_maps(dev, possible_mask, dev_maps, offset, | ||||||
| 			clean_xps_maps(dev, possible_mask, dev_maps, nr_ids, | 				       count, true); | ||||||
| 				       offset, count, true); |  | ||||||
| 		} |  | ||||||
| 	} | 	} | ||||||
| 
 | 
 | ||||||
| 	dev_maps = xmap_dereference(dev->xps_cpus_map); | 	dev_maps = xmap_dereference(dev->xps_cpus_map); | ||||||
| @ -2574,9 +2571,7 @@ static void netif_reset_xps_queues(struct net_device *dev, u16 offset, | |||||||
| 
 | 
 | ||||||
| 	if (num_possible_cpus() > 1) | 	if (num_possible_cpus() > 1) | ||||||
| 		possible_mask = cpumask_bits(cpu_possible_mask); | 		possible_mask = cpumask_bits(cpu_possible_mask); | ||||||
| 	nr_ids = nr_cpu_ids; | 	clean_xps_maps(dev, possible_mask, dev_maps, offset, count, false); | ||||||
| 	clean_xps_maps(dev, possible_mask, dev_maps, nr_ids, offset, count, |  | ||||||
| 		       false); |  | ||||||
| 
 | 
 | ||||||
| out_no_maps: | out_no_maps: | ||||||
| 	mutex_unlock(&xps_map_mutex); | 	mutex_unlock(&xps_map_mutex); | ||||||
| @ -2673,11 +2668,12 @@ int __netif_set_xps_queue(struct net_device *dev, const unsigned long *mask, | |||||||
| 		maps_sz = L1_CACHE_BYTES; | 		maps_sz = L1_CACHE_BYTES; | ||||||
| 
 | 
 | ||||||
| 	/* The old dev_maps could be larger or smaller than the one we're
 | 	/* The old dev_maps could be larger or smaller than the one we're
 | ||||||
| 	 * setting up now, as dev->num_tc could have been updated in between. We | 	 * setting up now, as dev->num_tc or nr_ids could have been updated in | ||||||
| 	 * could try to be smart, but let's be safe instead and only copy | 	 * between. We could try to be smart, but let's be safe instead and only | ||||||
| 	 * foreign traffic classes if the two map sizes match. | 	 * copy foreign traffic classes if the two map sizes match. | ||||||
| 	 */ | 	 */ | ||||||
| 	if (dev_maps && dev_maps->num_tc == num_tc) | 	if (dev_maps && | ||||||
|  | 	    dev_maps->num_tc == num_tc && dev_maps->nr_ids == nr_ids) | ||||||
| 		copy = true; | 		copy = true; | ||||||
| 
 | 
 | ||||||
| 	/* allocate memory for queue storage */ | 	/* allocate memory for queue storage */ | ||||||
| @ -2690,6 +2686,7 @@ int __netif_set_xps_queue(struct net_device *dev, const unsigned long *mask, | |||||||
| 				return -ENOMEM; | 				return -ENOMEM; | ||||||
| 			} | 			} | ||||||
| 
 | 
 | ||||||
|  | 			new_dev_maps->nr_ids = nr_ids; | ||||||
| 			new_dev_maps->num_tc = num_tc; | 			new_dev_maps->num_tc = num_tc; | ||||||
| 		} | 		} | ||||||
| 
 | 
 | ||||||
| @ -2770,7 +2767,7 @@ int __netif_set_xps_queue(struct net_device *dev, const unsigned long *mask, | |||||||
| 		goto out_no_old_maps; | 		goto out_no_old_maps; | ||||||
| 
 | 
 | ||||||
| 	for (j = -1; j = netif_attrmask_next(j, possible_mask, nr_ids), | 	for (j = -1; j = netif_attrmask_next(j, possible_mask, nr_ids), | ||||||
| 	     j < nr_ids;) { | 	     j < dev_maps->nr_ids;) { | ||||||
| 		for (i = num_tc, tci = j * dev_maps->num_tc; i--; tci++) { | 		for (i = num_tc, tci = j * dev_maps->num_tc; i--; tci++) { | ||||||
| 			map = xmap_dereference(dev_maps->attr_map[tci]); | 			map = xmap_dereference(dev_maps->attr_map[tci]); | ||||||
| 			if (!map) | 			if (!map) | ||||||
| @ -2804,12 +2801,12 @@ out_no_new_maps: | |||||||
| 		goto out_no_maps; | 		goto out_no_maps; | ||||||
| 
 | 
 | ||||||
| 	/* removes tx-queue from unused CPUs/rx-queues */ | 	/* removes tx-queue from unused CPUs/rx-queues */ | ||||||
| 	for (j = -1; j = netif_attrmask_next(j, possible_mask, nr_ids), | 	for (j = -1; j = netif_attrmask_next(j, possible_mask, dev_maps->nr_ids), | ||||||
| 	     j < nr_ids;) { | 	     j < dev_maps->nr_ids;) { | ||||||
| 		for (i = tc, tci = j * dev_maps->num_tc; i--; tci++) | 		for (i = tc, tci = j * dev_maps->num_tc; i--; tci++) | ||||||
| 			active |= remove_xps_queue(dev_maps, tci, index); | 			active |= remove_xps_queue(dev_maps, tci, index); | ||||||
| 		if (!netif_attr_test_mask(j, mask, nr_ids) || | 		if (!netif_attr_test_mask(j, mask, dev_maps->nr_ids) || | ||||||
| 		    !netif_attr_test_online(j, online_mask, nr_ids)) | 		    !netif_attr_test_online(j, online_mask, dev_maps->nr_ids)) | ||||||
| 			active |= remove_xps_queue(dev_maps, tci, index); | 			active |= remove_xps_queue(dev_maps, tci, index); | ||||||
| 		for (i = dev_maps->num_tc - tc, tci++; --i; tci++) | 		for (i = dev_maps->num_tc - tc, tci++; --i; tci++) | ||||||
| 			active |= remove_xps_queue(dev_maps, tci, index); | 			active |= remove_xps_queue(dev_maps, tci, index); | ||||||
| @ -3965,7 +3962,7 @@ static int __get_xps_queue_idx(struct net_device *dev, struct sk_buff *skb, | |||||||
| 	struct xps_map *map; | 	struct xps_map *map; | ||||||
| 	int queue_index = -1; | 	int queue_index = -1; | ||||||
| 
 | 
 | ||||||
| 	if (tc >= dev_maps->num_tc) | 	if (tc >= dev_maps->num_tc || tci >= dev_maps->nr_ids) | ||||||
| 		return queue_index; | 		return queue_index; | ||||||
| 
 | 
 | ||||||
| 	tci *= dev_maps->num_tc; | 	tci *= dev_maps->num_tc; | ||||||
| @ -4004,7 +4001,7 @@ static int get_xps_queue(struct net_device *dev, struct net_device *sb_dev, | |||||||
| 	if (dev_maps) { | 	if (dev_maps) { | ||||||
| 		int tci = sk_rx_queue_get(sk); | 		int tci = sk_rx_queue_get(sk); | ||||||
| 
 | 
 | ||||||
| 		if (tci >= 0 && tci < dev->num_rx_queues) | 		if (tci >= 0) | ||||||
| 			queue_index = __get_xps_queue_idx(dev, skb, dev_maps, | 			queue_index = __get_xps_queue_idx(dev, skb, dev_maps, | ||||||
| 							  tci); | 							  tci); | ||||||
| 	} | 	} | ||||||
|  | |||||||
| @ -1366,9 +1366,9 @@ static ssize_t xps_cpus_show(struct netdev_queue *queue, | |||||||
| { | { | ||||||
| 	struct net_device *dev = queue->dev; | 	struct net_device *dev = queue->dev; | ||||||
| 	struct xps_dev_maps *dev_maps; | 	struct xps_dev_maps *dev_maps; | ||||||
|  | 	unsigned int index, nr_ids; | ||||||
| 	int j, len, ret, tc = 0; | 	int j, len, ret, tc = 0; | ||||||
| 	unsigned long *mask; | 	unsigned long *mask; | ||||||
| 	unsigned int index; |  | ||||||
| 
 | 
 | ||||||
| 	if (!netif_is_multiqueue(dev)) | 	if (!netif_is_multiqueue(dev)) | ||||||
| 		return -ENOENT; | 		return -ENOENT; | ||||||
| @ -1387,19 +1387,20 @@ static ssize_t xps_cpus_show(struct netdev_queue *queue, | |||||||
| 		goto err_rtnl_unlock; | 		goto err_rtnl_unlock; | ||||||
| 	} | 	} | ||||||
| 
 | 
 | ||||||
| 	mask = bitmap_zalloc(nr_cpu_ids, GFP_KERNEL); |  | ||||||
| 	if (!mask) { |  | ||||||
| 		ret = -ENOMEM; |  | ||||||
| 		goto err_rtnl_unlock; |  | ||||||
| 	} |  | ||||||
| 
 |  | ||||||
| 	rcu_read_lock(); | 	rcu_read_lock(); | ||||||
| 	dev_maps = rcu_dereference(dev->xps_cpus_map); | 	dev_maps = rcu_dereference(dev->xps_cpus_map); | ||||||
|  | 	nr_ids = dev_maps ? dev_maps->nr_ids : nr_cpu_ids; | ||||||
|  | 
 | ||||||
|  | 	mask = bitmap_zalloc(nr_ids, GFP_KERNEL); | ||||||
|  | 	if (!mask) { | ||||||
|  | 		ret = -ENOMEM; | ||||||
|  | 		goto err_rcu_unlock; | ||||||
|  | 	} | ||||||
|  | 
 | ||||||
| 	if (!dev_maps || tc >= dev_maps->num_tc) | 	if (!dev_maps || tc >= dev_maps->num_tc) | ||||||
| 		goto out_no_maps; | 		goto out_no_maps; | ||||||
| 
 | 
 | ||||||
| 	for (j = -1; j = netif_attrmask_next(j, NULL, nr_cpu_ids), | 	for (j = -1; j = netif_attrmask_next(j, NULL, nr_ids), j < nr_ids;) { | ||||||
| 	     j < nr_cpu_ids;) { |  | ||||||
| 		int i, tci = j * dev_maps->num_tc + tc; | 		int i, tci = j * dev_maps->num_tc + tc; | ||||||
| 		struct xps_map *map; | 		struct xps_map *map; | ||||||
| 
 | 
 | ||||||
| @ -1419,10 +1420,12 @@ out_no_maps: | |||||||
| 
 | 
 | ||||||
| 	rtnl_unlock(); | 	rtnl_unlock(); | ||||||
| 
 | 
 | ||||||
| 	len = bitmap_print_to_pagebuf(false, buf, mask, nr_cpu_ids); | 	len = bitmap_print_to_pagebuf(false, buf, mask, nr_ids); | ||||||
| 	bitmap_free(mask); | 	bitmap_free(mask); | ||||||
| 	return len < PAGE_SIZE ? len : -EINVAL; | 	return len < PAGE_SIZE ? len : -EINVAL; | ||||||
| 
 | 
 | ||||||
|  | err_rcu_unlock: | ||||||
|  | 	rcu_read_unlock(); | ||||||
| err_rtnl_unlock: | err_rtnl_unlock: | ||||||
| 	rtnl_unlock(); | 	rtnl_unlock(); | ||||||
| 	return ret; | 	return ret; | ||||||
| @ -1473,9 +1476,9 @@ static ssize_t xps_rxqs_show(struct netdev_queue *queue, char *buf) | |||||||
| { | { | ||||||
| 	struct net_device *dev = queue->dev; | 	struct net_device *dev = queue->dev; | ||||||
| 	struct xps_dev_maps *dev_maps; | 	struct xps_dev_maps *dev_maps; | ||||||
|  | 	unsigned int index, nr_ids; | ||||||
| 	int j, len, ret, tc = 0; | 	int j, len, ret, tc = 0; | ||||||
| 	unsigned long *mask; | 	unsigned long *mask; | ||||||
| 	unsigned int index; |  | ||||||
| 
 | 
 | ||||||
| 	index = get_netdev_queue_index(queue); | 	index = get_netdev_queue_index(queue); | ||||||
| 
 | 
 | ||||||
| @ -1488,19 +1491,20 @@ static ssize_t xps_rxqs_show(struct netdev_queue *queue, char *buf) | |||||||
| 		goto err_rtnl_unlock; | 		goto err_rtnl_unlock; | ||||||
| 	} | 	} | ||||||
| 
 | 
 | ||||||
| 	mask = bitmap_zalloc(dev->num_rx_queues, GFP_KERNEL); |  | ||||||
| 	if (!mask) { |  | ||||||
| 		ret = -ENOMEM; |  | ||||||
| 		goto err_rtnl_unlock; |  | ||||||
| 	} |  | ||||||
| 
 |  | ||||||
| 	rcu_read_lock(); | 	rcu_read_lock(); | ||||||
| 	dev_maps = rcu_dereference(dev->xps_rxqs_map); | 	dev_maps = rcu_dereference(dev->xps_rxqs_map); | ||||||
|  | 	nr_ids = dev_maps ? dev_maps->nr_ids : dev->num_rx_queues; | ||||||
|  | 
 | ||||||
|  | 	mask = bitmap_zalloc(nr_ids, GFP_KERNEL); | ||||||
|  | 	if (!mask) { | ||||||
|  | 		ret = -ENOMEM; | ||||||
|  | 		goto err_rcu_unlock; | ||||||
|  | 	} | ||||||
|  | 
 | ||||||
| 	if (!dev_maps || tc >= dev_maps->num_tc) | 	if (!dev_maps || tc >= dev_maps->num_tc) | ||||||
| 		goto out_no_maps; | 		goto out_no_maps; | ||||||
| 
 | 
 | ||||||
| 	for (j = -1; j = netif_attrmask_next(j, NULL, dev->num_rx_queues), | 	for (j = -1; j = netif_attrmask_next(j, NULL, nr_ids), j < nr_ids;) { | ||||||
| 	     j < dev->num_rx_queues;) { |  | ||||||
| 		int i, tci = j * dev_maps->num_tc + tc; | 		int i, tci = j * dev_maps->num_tc + tc; | ||||||
| 		struct xps_map *map; | 		struct xps_map *map; | ||||||
| 
 | 
 | ||||||
| @ -1520,11 +1524,13 @@ out_no_maps: | |||||||
| 
 | 
 | ||||||
| 	rtnl_unlock(); | 	rtnl_unlock(); | ||||||
| 
 | 
 | ||||||
| 	len = bitmap_print_to_pagebuf(false, buf, mask, dev->num_rx_queues); | 	len = bitmap_print_to_pagebuf(false, buf, mask, nr_ids); | ||||||
| 	bitmap_free(mask); | 	bitmap_free(mask); | ||||||
| 
 | 
 | ||||||
| 	return len < PAGE_SIZE ? len : -EINVAL; | 	return len < PAGE_SIZE ? len : -EINVAL; | ||||||
| 
 | 
 | ||||||
|  | err_rcu_unlock: | ||||||
|  | 	rcu_read_unlock(); | ||||||
| err_rtnl_unlock: | err_rtnl_unlock: | ||||||
| 	rtnl_unlock(); | 	rtnl_unlock(); | ||||||
| 	return ret; | 	return ret; | ||||||
|  | |||||||
		Loading…
	
		Reference in New Issue
	
	Block a user