diff options
| author | Maxim Mikityanskiy <maximmi@mellanox.com> | 2021-01-18 18:03:33 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2021-01-27 11:55:10 +0100 |
| commit | 636868a52d33d664974eb5d6920d909c1ada6e3e (patch) | |
| tree | 5e8344c05915dc3e4886697b0aa116ad971b0cb0 | |
| parent | 517732c1b52b54824df68bb72b4030065e1aad47 (diff) | |
| download | kernel_replicant_linux-636868a52d33d664974eb5d6920d909c1ada6e3e.tar.gz kernel_replicant_linux-636868a52d33d664974eb5d6920d909c1ada6e3e.tar.bz2 kernel_replicant_linux-636868a52d33d664974eb5d6920d909c1ada6e3e.zip | |
xsk: Clear pool even for inactive queues
[ Upstream commit b425e24a934e21a502d25089c6c7443d799c5594 ]
The number of queues can change by other means, rather than ethtool. For
example, attaching an mqprio qdisc with num_tc > 1 leads to creating
multiple sets of TX queues, which may be then destroyed when mqprio is
deleted. If an AF_XDP socket is created while mqprio is active,
dev->_tx[queue_id].pool will be filled, but then real_num_tx_queues may
decrease with deletion of mqprio, which will mean that the pool won't be
NULLed, and a further increase of the number of TX queues may expose a
dangling pointer.
To avoid any potential misbehavior, this commit clears pool for RX and
TX queues, regardless of real_num_*_queues, still taking into
consideration num_*_queues to avoid overflows.
Fixes: 1c1efc2af158 ("xsk: Create and free buffer pool independently from umem")
Fixes: a41b4f3c58dd ("xsk: simplify xdp_clear_umem_at_qid implementation")
Signed-off-by: Maxim Mikityanskiy <maximmi@mellanox.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Björn Töpel <bjorn.topel@intel.com>
Link: https://lore.kernel.org/bpf/20210118160333.333439-1-maximmi@mellanox.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | net/xdp/xsk.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c index d5f42c62fd79..52fd1f96b241 100644 --- a/net/xdp/xsk.c +++ b/net/xdp/xsk.c @@ -107,9 +107,9 @@ EXPORT_SYMBOL(xsk_get_pool_from_qid); void xsk_clear_pool_at_qid(struct net_device *dev, u16 queue_id) { - if (queue_id < dev->real_num_rx_queues) + if (queue_id < dev->num_rx_queues) dev->_rx[queue_id].pool = NULL; - if (queue_id < dev->real_num_tx_queues) + if (queue_id < dev->num_tx_queues) dev->_tx[queue_id].pool = NULL; } |