net/ionic: avoid OOB TX partner lookup for hwstamp RXQ

The dedicated hardware timestamp RX queue is allocated with q->index
equal to lif->ionic->nrxqs_per_lif. The normal txqcqs array only
contains the regular queue pairs, so using that index to set rxq->partner
can read one entry past txqcqs[] and then write through the derived
pointer.
Only link RX/TX partners for normal queue-pair indexes. Leave the hwstamp
RX queue unpaired, and make the XDP_TX path abort cleanly if an RX queue
has no TX partner.

Fixes: 8eeed8373e ("ionic: Add XDP_TX support")
Reviewed-by: Si-Wei Liu <si-wei.liu@oracle.com>
Reviewed-by: Shannon Nelson <sln@onemain.com>
Cc: stable@vger.kernel.org
Signed-off-by: Anand Khoje <anand.a.khoje@oracle.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Reviewed-by: Brett Creeley <brett.creeley@amd.com>
Link: https://patch.msgid.link/20260813083705.454897-1-anand.a.khoje@oracle.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
This commit is contained in:
Anand Khoje
2026-08-13 08:37:05 +00:00
committed by Paolo Abeni
parent 47226bbdef
commit d92255b405
2 changed files with 21 additions and 3 deletions

View File

@@ -920,8 +920,21 @@ static int ionic_lif_rxq_init(struct ionic_lif *lif, struct ionic_qcq *qcq)
};
int err;
q->partner = &lif->txqcqs[q->index]->q;
q->partner->partner = q;
q->partner = NULL;
/* Only normal RX queues have matching TX queue partners. */
if (q->index < lif->nxqs) {
if (!lif->txqcqs ||
q->index >= lif->ionic->ntxqs_per_lif ||
!lif->txqcqs[q->index]) {
dev_err(dev, "missing TX queue partner for RX queue %u\n",
q->index);
return -ENXIO;
}
q->partner = &lif->txqcqs[q->index]->q;
q->partner->partner = q;
}
if (!lif->xdp_prog ||
(lif->xdp_prog->aux && lif->xdp_prog->aux->xdp_has_frags))

View File

@@ -545,13 +545,18 @@ static bool ionic_run_xdp(struct ionic_rx_stats *stats,
break;
case XDP_TX:
txq = rxq->partner;
if (unlikely(!txq)) {
err = -EIO;
break;
}
xdpf = xdp_convert_buff_to_frame(&xdp_buf);
if (!xdpf) {
err = -ENOSPC;
break;
}
txq = rxq->partner;
nq = netdev_get_tx_queue(netdev, txq->index);
__netif_tx_lock(nq, smp_processor_id());
txq_trans_cond_update(nq);