From patchwork Mon Mar 27 12:31:19 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jonas Jensen X-Patchwork-Id: 9646581 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id AB467602D6 for ; Mon, 27 Mar 2017 12:32:08 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 94FEC2097A for ; Mon, 27 Mar 2017 12:32:08 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 886AE27DA4; Mon, 27 Mar 2017 12:32:08 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-0.4 required=2.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED,DKIM_VALID,FREEMAIL_FROM,RCVD_IN_SORBS_WEB autolearn=no version=3.3.1 Received: from bombadil.infradead.org (bombadil.infradead.org [65.50.211.133]) (using TLSv1.2 with cipher AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 09B442097A for ; Mon, 27 Mar 2017 12:32:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Cc:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:Message-Id:Date: Subject:To:From:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To: References:List-Owner; bh=xixn6Gc7K/B0ZvPUb1T/wq2JfAXeWcKOjX5uvdJ0vgo=; b=YZJ HO8J/QLi/7xq/DgADCilBklWSVhT83+XYvGurMCJF9ll/qcc6RU8GyY9ttgjqYgcNGs/ZgbHlv27N YdGEBycEVE8U5xixQO2P6QCbTdqnfHtc/XcxGy0EmNOtyY0a93EVsU+8Ys/ZGM7Psg9lwnU9HgIaJ 0mZiG03+muR8H60zVzE2n/Xs2HtEkd4mPw3GgGApqJclYBKNCCAXQOn1+pWU1ZyHoeAoK0LIRS895 1fqLedUgJ2bSUv0eDjUzDdistD4eDvIhZINB/pvGuu/7+329pK9HeLl8cp/slUXeA9VBYe+iZBXbi BiMf1dGAY3EwalCb8sxVRP1vMKY3yDQ==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.87 #1 (Red Hat Linux)) id 1csTod-00020S-8x; Mon, 27 Mar 2017 12:32:07 +0000 Received: from mail-lf0-x244.google.com ([2a00:1450:4010:c07::244]) by bombadil.infradead.org with esmtps (Exim 4.87 #1 (Red Hat Linux)) id 1csToY-0001y8-5r for linux-arm-kernel@lists.infradead.org; Mon, 27 Mar 2017 12:32:05 +0000 Received: by mail-lf0-x244.google.com with SMTP id r36so7022257lfi.0 for ; Mon, 27 Mar 2017 05:31:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id; bh=zcXCBKoBaOtj4WQmbkUEkzaOY2rzzoHPrAtotCUBxow=; b=CaqPPsh2Ob55NGMVrqa+oB1gSpDcULoqpFJcOLzBhUMbjl5Yu4c0yS+CPar0rrUItg bn/ZG/sou36pDtzKl3inhYOH3hsWFaSCg91K++REXq+BYnxGNV4JkEWwO8LRpxeAD234 4Pyme/U/ID9szFwYbmqlliHNtAXP8rIfjaiUo+VBFcWftGmaDBwWbwHThiozELAvfMrj bzHzK/9LzyHrXhGoGQbDcKfENLxrzgFGxNtgMIPXV2DY86Nm8oCbdWojCGeItdeZvoUj xsgkYyAKPuglujviIj9bOKkVidEocyxz64MW1SfvTTS8VR3GYgPM8cdDxHLGiBNUsowh qURg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=zcXCBKoBaOtj4WQmbkUEkzaOY2rzzoHPrAtotCUBxow=; b=W+q+XQ4Bsk+xOt726Qm7BeLoXlVM5uIDQEj0DbpDNm9D9ymNcBpoAcoC8TqshbRS8r qWI68jDAaXaklZUX2apcNUBrENEwikK5J/J8DCn3fB4y0YSRvqWAW8XoynL0nYWYSErP Ay5aX+7R6QDqzIZHIIeURnlcGT4gav6ZZRtqE2IxN3aZMHWZYsKf8sLiOZQL7A88ptyF PD2FR3JhQEXDZOBfpDoay4LGZVHh1LhGlljoSLn46FyXe4JGOi/RRK3o3fP8XT2vKlD1 ciifnB5y691HcrK5r1w+/VsFqp+7nrkJNsdg7/Of4NbYn0nJbpvtqyRBM/LwBegcII1G 59ng== X-Gm-Message-State: AFeK/H2lZ8OG2JBeIxBsvazKzNoNPt2WwXiNsAR9oQFl+sBOsxKWSNi7rNP0t46OXcNFbw== X-Received: by 10.25.21.37 with SMTP id l37mr10626253lfi.146.1490617899564; Mon, 27 Mar 2017 05:31:39 -0700 (PDT) Received: from ildjarn.test.com (static-213-115-41-10.sme.bredbandsbolaget.se. [213.115.41.10]) by smtp.gmail.com with ESMTPSA id m27sm99670ljb.24.2017.03.27.05.31.38 (version=TLS1 cipher=AES128-SHA bits=128/128); Mon, 27 Mar 2017 05:31:38 -0700 (PDT) From: Jonas Jensen To: netdev@vger.kernel.org Subject: [PATCH v2] net: moxa: fix TX overrun memory leak Date: Mon, 27 Mar 2017 14:31:19 +0200 Message-Id: <1490617879-14014-1-git-send-email-jonas.jensen@gmail.com> X-Mailer: git-send-email 1.8.2.1 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20170327_053202_440935_9BC0D5A9 X-CRM114-Status: GOOD ( 13.42 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, Jonas Jensen MIME-Version: 1.0 Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org X-Virus-Scanned: ClamAV using ClamSMTP moxart_mac_start_xmit() doesn't care where tx_tail is, tx_head can catch and pass tx_tail, which is bad because moxart_tx_finished() isn't guaranteed to catch up on freeing resources from tx_tail. Add a check in moxart_mac_start_xmit() stopping the queue at the end of the circular buffer. Wake it on completion. Addresses https://bugzilla.kernel.org/show_bug.cgi?id=99451 Signed-off-by: Jonas Jensen --- Notes: ChangeLog v1->v2: - stop queue instead of dropping frames The following trick was used to trigger the leak. On the host (where this driver runs): 1. iptables-restore /etc/iptables.conf && echo 1 > /proc/sys/net/ipv4/ip_forward && ifconfig eth0:0 192.168.5.1 2. cat /dev/zero | nc -l -p 3334 On a client configured with 192.168.5.1 as a gateway: 1. nc -v 192.168.5.1 3334 > /dev/null & repeat the following multiple times, interrup after a few seconds with CTRL+C: 2. wget http://cdimage.debian.org/debian-cd/current/amd64/iso-cd/debian-8.7.1-amd64-netinst.iso Result (especially note columns and of kmalloc-192 and kmalloc-2048): date && ifconfig && echo 1 > /proc/sys/vm/drop_caches && cat /proc/slabinfo Fri Mar 24 16:22:54 CET 2017 .. RX bytes:57737 (56.3 KiB) TX bytes:6638 (6.4 KiB) .. # name : tunables .. .. kmalloc-8192 8 8 8192 4 8 : tunables 0 0 0 : slabdata 2 2 0 kmalloc-4096 13 16 4096 8 8 : tunables 0 0 0 : slabdata 2 2 0 kmalloc-2048 40 40 2048 8 4 : tunables 0 0 0 : slabdata 5 5 0 kmalloc-1024 94 96 1024 8 2 : tunables 0 0 0 : slabdata 12 12 0 kmalloc-512 179 184 512 8 1 : tunables 0 0 0 : slabdata 23 23 0 kmalloc-256 76 80 256 16 1 : tunables 0 0 0 : slabdata 5 5 0 kmalloc-192 126 126 192 21 1 : tunables 0 0 0 : slabdata 6 6 0 kmalloc-128 340 416 128 32 1 : tunables 0 0 0 : slabdata 13 13 0 kmalloc-96 8353 8358 96 42 1 : tunables 0 0 0 : slabdata 199 199 0 kmalloc-64 313 320 64 64 1 : tunables 0 0 0 : slabdata 5 5 0 kmalloc-32 1460 1536 32 128 1 : tunables 0 0 0 : slabdata 12 12 0 date && ifconfig && echo 1 > /proc/sys/vm/drop_caches && cat /proc/slabinfo Fri Mar 24 16:26:36 CET 2017 .. RX bytes:70381213 (67.1 MiB) TX bytes:86208719 (82.2 MiB) .. # name : tunables .. .. kmalloc-8192 8 8 8192 4 8 : tunables 0 0 0 : slabdata 2 2 0 kmalloc-4096 13 16 4096 8 8 : tunables 0 0 0 : slabdata 2 2 0 kmalloc-2048 2159 2194 2048 8 4 : tunables 0 0 0 : slabdata 275 275 0 kmalloc-1024 100 104 1024 8 2 : tunables 0 0 0 : slabdata 13 13 0 kmalloc-512 182 184 512 8 1 : tunables 0 0 0 : slabdata 23 23 0 kmalloc-256 76 80 256 16 1 : tunables 0 0 0 : slabdata 5 5 0 kmalloc-192 2638 2667 192 21 1 : tunables 0 0 0 : slabdata 127 127 0 kmalloc-128 344 416 128 32 1 : tunables 0 0 0 : slabdata 13 13 0 kmalloc-96 8353 8358 96 42 1 : tunables 0 0 0 : slabdata 199 199 0 kmalloc-64 313 320 64 64 1 : tunables 0 0 0 : slabdata 5 5 0 kmalloc-32 1625 1664 32 128 1 : tunables 0 0 0 : slabdata 13 13 0 Applies to next-20170310 drivers/net/ethernet/moxa/moxart_ether.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/moxa/moxart_ether.c b/drivers/net/ethernet/moxa/moxart_ether.c index 06c9f41..fa571d5 100644 --- a/drivers/net/ethernet/moxa/moxart_ether.c +++ b/drivers/net/ethernet/moxa/moxart_ether.c @@ -25,6 +25,7 @@ #include #include #include +#include #include "moxart_ether.h" @@ -297,6 +298,7 @@ static void moxart_tx_finished(struct net_device *ndev) tx_tail = TX_NEXT(tx_tail); } priv->tx_tail = tx_tail; + netif_wake_queue(ndev); } static irqreturn_t moxart_mac_interrupt(int irq, void *dev_id) @@ -324,13 +326,19 @@ static int moxart_mac_start_xmit(struct sk_buff *skb, struct net_device *ndev) struct moxart_mac_priv_t *priv = netdev_priv(ndev); void *desc; unsigned int len; - unsigned int tx_head = priv->tx_head; + unsigned int tx_head, tx_tail; u32 txdes1; int ret = NETDEV_TX_BUSY; + spin_lock_irq(&priv->txlock); + + tx_head = priv->tx_head; + tx_tail = priv->tx_tail; desc = priv->tx_desc_base + (TX_REG_DESC_SIZE * tx_head); - spin_lock_irq(&priv->txlock); + if (CIRC_SPACE(tx_head, tx_tail, TX_DESC_NUM) == 1) + netif_stop_queue(ndev); + if (moxart_desc_read(desc + TX_REG_OFFSET_DESC0) & TX_DESC0_DMA_OWN) { net_dbg_ratelimited("no TX space for packet\n"); priv->stats.tx_dropped++;