• Lorenzo Bianconi's avatar
    net: thunderx: set tso_hdrs pointer to NULL in nicvf_free_snd_queue · ef2a7cf1
    Lorenzo Bianconi authored
    Reset snd_queue tso_hdrs pointer to NULL in nicvf_free_snd_queue routine
    since it is used to check if tso dma descriptor queue has been previously
    allocated. The issue can be triggered with the following reproducer:
    
    $ip link set dev enP2p1s0v0 xdpdrv obj xdp_dummy.o
    $ip link set dev enP2p1s0v0 xdpdrv off
    
    [  341.467649] WARNING: CPU: 74 PID: 2158 at mm/vmalloc.c:1511 __vunmap+0x98/0xe0
    [  341.515010] Hardware name: GIGABYTE H270-T70/MT70-HD0, BIOS T49 02/02/2018
    [  341.521874] pstate: 60400005 (nZCv daif +PAN -UAO)
    [  341.526654] pc : __vunmap+0x98/0xe0
    [  341.530132] lr : __vunmap+0x98/0xe0
    [  341.533609] sp : ffff00001c5db860
    [  341.536913] x29: ffff00001c5db860 x28: 0000000000020000
    [  341.542214] x27: ffff810feb5090b0 x26: ffff000017e57000
    [  341.547515] x25: 0000000000000000 x24: 00000000fbd00000
    [  341.552816] x23: 0000000000000000 x22: ffff810feb5090b0
    [  341.558117] x21: 0000000000000000 x20: 0000000000000000
    [  341.563418] x19: ffff000017e57000 x18: 0000000000000000
    [  341.568719] x17: 0000000000000000 x16: 0000000000000000
    [  341.574020] x15: 0000000000000010 x14: ffffffffffffffff
    [  341.579321] x13: ffff00008985eb27 x12: ffff00000985eb2f
    [  341.584622] x11: ffff0000096b3000 x10: ffff00001c5db510
    [  341.589923] x9 : 00000000ffffffd0 x8 : ffff0000086868e8
    [  341.595224] x7 : 3430303030303030 x6 : 00000000000006ef
    [  341.600525] x5 : 00000000003fffff x4 : 0000000000000000
    [  341.605825] x3 : 0000000000000000 x2 : ffffffffffffffff
    [  341.611126] x1 : ffff0000096b3728 x0 : 0000000000000038
    [  341.616428] Call trace:
    [  341.618866]  __vunmap+0x98/0xe0
    [  341.621997]  vunmap+0x3c/0x50
    [  341.624961]  arch_dma_free+0x68/0xa0
    [  341.628534]  dma_direct_free+0x50/0x80
    [  341.632285]  nicvf_free_resources+0x160/0x2d8 [nicvf]
    [  341.637327]  nicvf_config_data_transfer+0x174/0x5e8 [nicvf]
    [  341.642890]  nicvf_stop+0x298/0x340 [nicvf]
    [  341.647066]  __dev_close_many+0x9c/0x108
    [  341.650977]  dev_close_many+0xa4/0x158
    [  341.654720]  rollback_registered_many+0x140/0x530
    [  341.659414]  rollback_registered+0x54/0x80
    [  341.663499]  unregister_netdevice_queue+0x9c/0xe8
    [  341.668192]  unregister_netdev+0x28/0x38
    [  341.672106]  nicvf_remove+0xa4/0xa8 [nicvf]
    [  341.676280]  nicvf_shutdown+0x20/0x30 [nicvf]
    [  341.680630]  pci_device_shutdown+0x44/0x88
    [  341.684720]  device_shutdown+0x144/0x250
    [  341.688640]  kernel_restart_prepare+0x44/0x50
    [  341.692986]  kernel_restart+0x20/0x68
    [  341.696638]  __se_sys_reboot+0x210/0x238
    [  341.700550]  __arm64_sys_reboot+0x24/0x30
    [  341.704555]  el0_svc_handler+0x94/0x110
    [  341.708382]  el0_svc+0x8/0xc
    [  341.711252] ---[ end trace 3f4019c8439959c9 ]---
    [  341.715874] page:ffff7e0003ef4000 count:0 mapcount:0 mapping:0000000000000000 index:0x4
    [  341.723872] flags: 0x1fffe000000000()
    [  341.727527] raw: 001fffe000000000 ffff7e0003f1a008 ffff7e0003ef4048 0000000000000000
    [  341.735263] raw: 0000000000000004 0000000000000000 00000000ffffffff 0000000000000000
    [  341.742994] page dumped because: VM_BUG_ON_PAGE(page_ref_count(page) == 0)
    
    where xdp_dummy.c is a simple bpf program that forwards the incoming
    frames to the network stack (available here:
    https://github.com/altoor/xdp_walkthrough_examples/blob/master/sample_1/xdp_dummy.c)
    
    Fixes: 05c773f5 ("net: thunderx: Add basic XDP support")
    Fixes: 4863dea3 ("net: Adding support for Cavium ThunderX network controller")
    Signed-off-by: default avatarLorenzo Bianconi <lorenzo.bianconi@redhat.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    ef2a7cf1
nicvf_queues.c 51.6 KB