• Taehee Yoo's avatar
    net: sfc: fix memory leak due to ptp channel · 49e6123c
    Taehee Yoo authored
    It fixes memory leak in ring buffer change logic.
    
    When ring buffer size is changed(ethtool -G eth0 rx 4096), sfc driver
    works like below.
    1. stop all channels and remove ring buffers.
    2. allocates new buffer array.
    3. allocates rx buffers.
    4. start channels.
    
    While the above steps are working, it skips some steps if the channel
    doesn't have a ->copy callback function.
    Due to ptp channel doesn't have ->copy callback, these above steps are
    skipped for ptp channel.
    It eventually makes some problems.
    a. ptp channel's ring buffer size is not changed, it works only
       1024(default).
    b. memory leak.
    
    The reason for memory leak is to use the wrong ring buffer values.
    There are some values, which is related to ring buffer size.
    a. efx->rxq_entries
     - This is global value of rx queue size.
    b. rx_queue->ptr_mask
     - used for access ring buffer as circular ring.
     - roundup_pow_of_two(efx->rxq_entries) - 1
    c. rx_queue->max_fill
     - efx->rxq_entries - EFX_RXD_HEAD_ROOM
    
    These all values should be based on ring buffer size consistently.
    But ptp channel's values are not.
    a. efx->rxq_entries
     - This is global(for sfc) value, always new ring buffer size.
    b. rx_queue->ptr_mask
     - This is always 1023(default).
    c. rx_queue->max_fill
     - This is new ring buffer size - EFX_RXD_HEAD_ROOM.
    
    Let's assume we set 4096 for rx ring buffer,
    
                          normal channel     ptp channel
    efx->rxq_entries      4096               4096
    rx_queue->ptr_mask    4095               1023
    rx_queue->max_fill    4086               4086
    
    sfc driver allocates rx ring buffers based on these values.
    When it allocates ptp channel's ring buffer, 4086 ring buffers are
    allocated then, these buffers are attached to the allocated array.
    But ptp channel's ring buffer array size is still 1024(default)
    and ptr_mask is still 1023 too.
    So, 3062 ring buffers will be overwritten to the array.
    This is the reason for memory leak.
    
    Test commands:
       ethtool -G <interface name> rx 4096
       while :
       do
           ip link set <interface name> up
           ip link set <interface name> down
       done
    
    In order to avoid this problem, it adds ->copy callback to ptp channel
    type.
    So that rx_queue->ptr_mask value will be updated correctly.
    
    Fixes: 7c236c43 ("sfc: Add support for IEEE-1588 PTP")
    Signed-off-by: default avatarTaehee Yoo <ap420073@gmail.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    49e6123c
ptp.h 1.97 KB