diff options
| author | Yunsheng Lin <linyunsheng@huawei.com> | 2019-04-25 20:42:45 +0800 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2019-04-26 12:13:28 -0400 |
| commit | 26cda2f1613878d9bde11325559f4fca92fff395 (patch) | |
| tree | 96d9e8b0e49c895a426e2725d195ed2e4580629f /drivers | |
| parent | 790d23e7c577ed2ef7c49f246ad8d53691fb1b20 (diff) | |
| download | linux-rpi-26cda2f1613878d9bde11325559f4fca92fff395.tar.gz linux-rpi-26cda2f1613878d9bde11325559f4fca92fff395.tar.bz2 linux-rpi-26cda2f1613878d9bde11325559f4fca92fff395.zip | |
net: hns3: fix data race between ring->next_to_clean
hns3_clean_tx_ring calls hns3_nic_reclaim_one_desc to clean
buffers and set ring->next_to_clean, then hns3_nic_net_xmit
reuses the cleaned buffers. But there are no memory barriers
when buffers gets recycled, so the recycled buffers can be
corrupted.
This patch uses smp_store_release to update ring->next_to_clean
and smp_load_acquire to read ring->next_to_clean to properly
hand off buffers from hns3_clean_tx_ring to hns3_nic_net_xmit.
Fixes: 76ad4f0ee747 ("net: hns3: Add support of HNS3 Ethernet Driver for hip08 SoC")
Signed-off-by: Yunsheng Lin <linyunsheng@huawei.com>
Signed-off-by: Peng Li <lipeng321@huawei.com>
Signed-off-by: Huazhong Tan <tanhuazhong@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 14 | ||||
| -rw-r--r-- | drivers/net/ethernet/hisilicon/hns3/hns3_enet.h | 7 |
2 files changed, 16 insertions, 5 deletions
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c index 176d4b965709..9fdc87e7e9f2 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c @@ -2214,14 +2214,22 @@ static void hns3_reuse_buffer(struct hns3_enet_ring *ring, int i) static void hns3_nic_reclaim_one_desc(struct hns3_enet_ring *ring, int *bytes, int *pkts) { - struct hns3_desc_cb *desc_cb = &ring->desc_cb[ring->next_to_clean]; + int ntc = ring->next_to_clean; + struct hns3_desc_cb *desc_cb; + desc_cb = &ring->desc_cb[ntc]; (*pkts) += (desc_cb->type == DESC_TYPE_SKB); (*bytes) += desc_cb->length; /* desc_cb will be cleaned, after hnae3_free_buffer_detach*/ - hns3_free_buffer_detach(ring, ring->next_to_clean); + hns3_free_buffer_detach(ring, ntc); - ring_ptr_move_fw(ring, next_to_clean); + if (++ntc == ring->desc_num) + ntc = 0; + + /* This smp_store_release() pairs with smp_load_acquire() in + * ring_space called by hns3_nic_net_xmit. + */ + smp_store_release(&ring->next_to_clean, ntc); } static int is_valid_clean_head(struct hns3_enet_ring *ring, int h) diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h index cec56a505e85..2b4f5ea3fddf 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h +++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h @@ -581,8 +581,11 @@ union l4_hdr_info { static inline int ring_space(struct hns3_enet_ring *ring) { - int begin = ring->next_to_clean; - int end = ring->next_to_use; + /* This smp_load_acquire() pairs with smp_store_release() in + * hns3_nic_reclaim_one_desc called by hns3_clean_tx_ring. + */ + int begin = smp_load_acquire(&ring->next_to_clean); + int end = READ_ONCE(ring->next_to_use); return ((end >= begin) ? (ring->desc_num - end + begin) : (begin - end)) - 1; |