• John Fastabend's avatar
    ixgbe: deleting dfwd stations out of order can cause null ptr deref · 51f3773b
    John Fastabend authored
    The number of stations in use is kept in the num_rx_pools counter
    in the ixgbe_adapter structure. This is in turn used by the queue
    allocation scheme to determine how many queues are needed to support
    the number of pools in use with the current feature set.
    
    This works as long as the pools are added and destroyed in order
    because (num_rx_pools * queues_per_pool) is equal to the last
    queue in use by a pool. But as soon as you delete a pool out of
    order this is no longer the case. So the above multiplication
    allocates to few queues and a pool may reference a ring that has
    not been allocated/initialized.
    
    To resolve use the bit mask of in use pools to determine the final
    pool being used and allocate enough queues so that we don't
    inadvertently remove its queues.
    
    # ip link add link eth2 \
    	numtxqueues 4 numrxqueues 4 txqueuelen 50 type macvlan
    # ip link set dev macvlan0 up
    # ip link add link eth2 \
    	numtxqueues 4 numrxqueues 4 txqueuelen 50 type macvlan
    # ip link set dev macvlan1 up
    # for i in {0..100}; do
      ip link set dev macvlan0 down; ip link set dev macvlan0 up;
      done;
    Signed-off-by: default avatarJohn Fastabend <john.r.fastabend@intel.com>
    Acked-by: default avatarNeil Horman <nhorman@tuxdriver.com>
    Acked-by: default avatarJeff Kirsher <jeffrey.t.kirsher@intel.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    51f3773b
ixgbe_main.c 233 KB