[hns-1126]net: hns3: refine for set ring parameters

Bug #1853965 reported by Fred Kimmy on 2019-11-26
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
kunpeng920
Undecided
Unassigned
Ubuntu-18.04
Undecided
Unassigned
Ubuntu-18.04-hwe
Undecided
Unassigned
Ubuntu-19.04
Undecided
Unassigned
Ubuntu-19.10
Undecided
Unassigned
Ubuntu-20.04
Undecided
Unassigned
Upstream-kernel
Undecided
Unassigned

Bug Description

[Bug Description]
Previously, when changing the ring parameters, we free the old
ring resources firstly, and then setup the new ring resources.
In some case of an allocation fail, there will be no resources
to use.

[Steps to Reproduce]
1.load PF&VF driver
2.allocate 8 VF for each PF
3.tesgine send tcp/udp packets to ports
4.modify VF queue depth by ethtool -G command

[Actual Results]
Kernel break down by NULL pointer.
ethtool -G eth15 tx 32768 rx 3276[ 4269.988246] hns3 0000:7d:02.2 eth15: Changing Tx/Rx ring depth from 1024/1024 to 32768/32768
8
[ 4270.010318] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
[ 4270.019096] Mem abort info:
[ 4270.021880] ESR = 0x96000006
[ 4270.024924] Exception class = DABT (current EL), IL = 32 bits
[ 4270.030832] SET = 0, FnV = 0
[ 4270.033875] EA = 0, S1PTW = 0
[ 4270.037005] Data abort info:
[ 4270.039872] ISV = 0, ISS = 0x00000006
[ 4270.043696] CM = 0, WnR = 0
[ 4270.046655] user pgtable: 4k pages, 48-bit VAs, pgdp = 00000000414534bd
[ 4270.053258] [0000000000000000] pgd=00000020805ad003, pud=00000020805b6003, pmd=0000000000000000
[ 4270.061947] Internal error: Oops: 96000006 [#1] SMP
[ 4270.066812] CPU: 37 PID: 17447 Comm: ethtool Tainted: G W OE 4.19.30-vhulk1903.5.1.h163.eulerosv3r1.aarch64 #2
[ 4270.077838] Hardware name: Huawei Technologies Co., Ltd. EVBCS/EVBCS, BIOS CS SPC100B010 1P TA 05/26/2019
[ 4270.087389] pstate: 40400009 (nZcv daif +PAN -UAO)
[ 4270.092170] pc : hns3_free_buffer_detach+0x30/0x80 [hns3]
[ 4270.097556] lr : hns3_free_desc+0x38/0x118 [hns3]
[ 4270.102245] sp : ffff8020cbe8f9e0
[ 4270.105545] x29: ffff8020cbe8f9e0 x28: ffff802754d10f00
[ 4270.110843] x27: 0000000000000000 x26: 0000000000000001
[ 4270.116141] x25: ffff80271ad8b8c0 x24: 0000000000000400
[ 4270.121439] x23: 0000000000000198 x22: ffff80271ad8b8c0
[ 4270.126737] x21: 0000000000000000 x20: ffff80275c847c80
[ 4270.132034] x19: 0000000000000000 x18: 0000000000000010
[ 4270.137332] x17: 0000000000000000 x16: 0000000000000000
[ 4270.142629] x15: ffff0000895099df x14: 6f7420343230312f
[ 4270.147927] x13: 34323031206d6f72 x12: ffff00000930b838
[ 4270.153224] x11: ffff0000086bfe70 x10: 785420676e69676e
[ 4270.158522] x9 : 00000000000271a1 x8 : 746520322e32303a
[ 4270.163819] x7 : 64373a3030303020 x6 : ffff8027dfacd270
[ 4270.169117] x5 : ffff8027dfacd270 x4 : 0000000000000000
[ 4270.174414] x3 : ffff8027dfad5848 x2 : 0ecdb7f3d9c07600
[ 4270.179712] x1 : 0000000000000000 x0 : 0000000000000000
[ 4270.185010] Process ethtool (pid: 17447, stack limit = 0x000000003a407b44)
[ 4270.191869] Call trace:
[ 4270.194304] hns3_free_buffer_detach+0x30/0x80 [hns3]
[ 4270.199342] hns3_free_desc+0x38/0x118 [hns3]
[ 4270.203685] hns3_fini_ring+0x20/0x58 [hns3]
[ 4270.207942] hns3_uninit_all_ring+0x48/0x88 [hns3]
[ 4270.212719] hns3_set_ringparam+0x11c/0x208 [hns3]
[ 4270.217498] dev_ethtool+0x1654/0x22d8
[ 4270.221234] dev_ioctl+0x19c/0x420
[ 4270.224622] sock_do_ioctl+0xf8/0x220
[ 4270.228270] sock_ioctl+0x290/0x598
[ 4270.231746] do_vfs_ioctl+0xc4/0x838
[ 4270.235307] ksys_ioctl+0x8c/0x98
[ 4270.238608] __arm64_sys_ioctl+0x28/0x38
[ 4270.242517] el0_svc_common+0xa0/0x180
[ 4270.246252] el0_svc_handler+0x38/0x78
[ 4270.249987] el0_svc+0x8/0xc
[ 4270.252854] Code: 52800500 f9400a81 9b207e60 8b000035 (f8606822)
[ 4270.258933] Modules linked in: hclgevf(OE) hns3_dfx(OE) hns3(OE) hclge(OE) hnae3(OE)
[ 4270.266667] ---[ end trace d3f59d7a2d086cd1 ]---
[ 4270.271270] Kernel panic - not syncing: Fatal exception
[ 4270.276480] kernel fault(0x5) notification starting on CPU 37
[ 4270.282210] kernel fault(0x5) notification finished on CPU 37
[ 4270.287942] SMP: stopping secondary CPUs
[ 4270.291859] Kernel Offset: disabled
[ 4270.295334] CPU features: 0x2,a2a00a38
[ 4270.299068] Memory Limit: none
[ 4270.302119] kernel reboot(0x2) notification starting on CPU 37
[ 4270.307937] kernel reboot(0x2) notification finished on CPU 37
[ 4270.313755] ---[ end Kernel panic - not syncing: Fatal exception ]---

[Expected Results]
Ok.

[Reproducibility]
Inevitably

[Additional information]
Hardware: D06
Firmware: NA
Kernel: NA

[Resolution]
This patch refines it by setup new ring resources and
free the old ring resources in order.

net: hns3: refine for set ring parameters
net: hns3: fix double free bug when setting ringparam

description: updated
Fred Kimmy (kongzizaixian) wrote :

Can you merge aboving patchset into ubuntu 18.04.1\ubuntu18.04.3 update\ubuntu 18.04.4 release version?

Ike Panhc (ikepanhc) wrote :

Could you provide step-by-step commands to reproduce this issue?

tags: added: backport
Ike Panhc (ikepanhc) on 2019-12-03
Changed in kunpeng920:
status: New → Incomplete
Fred Kimmy (kongzizaixian) wrote :

1.load PF&VF driver --hns3 pf vf driver
2.allocate 8 VF for each PF
example:echo 8 > /sys/bus/pci/devices/0000\:7d\:00.0/sriov_numvfs
3.tesgine send tcp/udp packets to ports
use this tesgine device to send this tcp/udp package.
4.modify VF queue depth by ethtool -G command
#!/bin/sh
while [ 1 ]
do
for (( i = 0; i < 7; i++ ))
 do
     echo "ethtool -G eth$i tx 32760 rx 32760"
  ethtool -G eth$i tx 32760 rx 32760 | tee -a result.txt
    sleep 1s
     echo "ethtool -G eth$i tx 4096 rx 4096"
  ethtool -G eth$i tx 4096 rx 4096 | tee -a result.txt
    sleep 1s
    done
done

Ike Panhc (ikepanhc) on 2019-12-10
Changed in kunpeng920:
status: Incomplete → New
Ike Panhc (ikepanhc) wrote :

These 2 patches are landed in v5.4 mainline kernel and the second patch

  net: hns3: fix double free bug when setting ringparam

fixes a bug for

  net: hns3: refine for set ring parameters

This bug can not be reproduce in any of Ubuntu kernel so set to invalid.

Ike Panhc (ikepanhc) on 2020-01-01
tags: removed: backport
Ike Panhc (ikepanhc) on 2020-01-07
Changed in kunpeng920:
status: New → Fix Committed
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers