From: Niklas Cassel <niklas.cassel@axis•com>
To: Jose Abreu <Jose.Abreu@synopsys•com>
Cc: Joao Pinto <Joao.Pinto@synopsys•com>,
linux-netdev <netdev@vger•kernel.org>,
Giuseppe CAVALLARO <peppe.cavallaro@st•com>,
alexandre.torgue@st•com
Subject: Re: Commit 05cf0d1bf4 ("net: stmmac: free an skb first when there are no longer any descriptors using it") breaks stmmac?
Date: Fri, 16 Feb 2018 11:10:52 +0100 [thread overview]
Message-ID: <20180216101052.GA30955@axis.com> (raw)
In-Reply-To: <a0bcc221-2dd5-7e48-0a12-8db22d6cd260@synopsys.com>
On Fri, Feb 16, 2018 at 09:34:39AM +0000, Jose Abreu wrote:
> Hi Niklas,
>
> Thank you for looking into this!
>
> On 13-02-2018 13:33, Niklas Cassel wrote:
> > Hello Jose,
> >
> >
> > I remember that you had a problem
> > with a use after free in stmmac_tx_clean().
> > I still don't think that it is related to
> > commit 05cf0d1bf4, however, when comparing
> > the stmmac driver to the amd-xgbe driver
> > I realized that:
> >
> > xgbe_tx_poll() has both a smp_rmb() after fetching
> > cur_tx, and also a dma_rmb() after reading the own
> > bit, before reading any other descriptor fields.
> >
> > stmmac_tx_clean() has neither a smp_rmb() or a
> > dma_rmb().
This still applies as far as I can tell.
> >
> >
> > Also
> > xgbe_dev_xmit() has a dma_wmb() _before_ setting
> > the own bit, and a smp_wmb() after setting the own
> > bit.
> >
> > stmmac simply has a dma_wmb() _after_ setting the
> > own bit.
For dwmac4, stmmac actually has a another dma_wmb() hidden in
dwmac4_rd_prepare_tx_desc().
It might be more obvious, since there already is a dma_wmb()
in stmmac_xmit()/stmmac_tso_xmit(), if this was also placed
there. We already have a set_owner() abstraction.
xgbe also has a dma_wmb() in dwmac4_release_tx_desc(),
which we appear to be missing.
Pehaps we want it right after the
priv->hw->desc->release_tx_desc(p, priv->mode)
call, so we don't hide it in the different implementations.
> > If you can still reproduce your problem quite easily,
> > perhaps you could try to make stmmac look more like
> > xgbe in these regards, and see if that solves your
> > use after free crash in stmmac_tx_clean().
>
> At the time it would be easily reproduced if I flooded the
> interface. I will check xgbe barriers and check if it should also
> be used in stmmac.
I've fixed the tx timeout for multiqueues when running iperf3
(mss was not set per tx queue, as reported in another thread).
Will send out a patch today.
Regards,
Niklas
prev parent reply other threads:[~2018-02-16 10:10 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-11-27 14:41 Commit 05cf0d1bf4 ("net: stmmac: free an skb first when there are no longer any descriptors using it") breaks stmmac? Jose Abreu
2017-11-30 3:51 ` Niklas Cassel
2017-11-30 16:50 ` Jose Abreu
2017-12-06 12:14 ` Niklas Cassel
2018-02-13 13:33 ` Niklas Cassel
2018-02-16 9:34 ` Jose Abreu
2018-02-16 10:10 ` Niklas Cassel [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180216101052.GA30955@axis.com \
--to=niklas.cassel@axis$(echo .)com \
--cc=Joao.Pinto@synopsys$(echo .)com \
--cc=Jose.Abreu@synopsys$(echo .)com \
--cc=alexandre.torgue@st$(echo .)com \
--cc=netdev@vger$(echo .)kernel.org \
--cc=peppe.cavallaro@st$(echo .)com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox