mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2026-03-03 00:55:43 -05:00
Kernel panic occurs when a devmem TCP socket is closed after NIC module
is unloaded.
This is Devmem TCP unregistration scenarios. number is an order.
(a)netlink socket close (b)pp destroy (c)uninstall result
1 2 3 OK
1 3 2 (d)Impossible
2 1 3 OK
3 1 2 (e)Kernel panic
2 3 1 (d)Impossible
3 2 1 (d)Impossible
(a) netdev_nl_sock_priv_destroy() is called when devmem TCP socket is
closed.
(b) page_pool_destroy() is called when the interface is down.
(c) mp_ops->uninstall() is called when an interface is unregistered.
(d) There is no scenario in mp_ops->uninstall() is called before
page_pool_destroy().
Because unregister_netdevice_many_notify() closes interfaces first
and then calls mp_ops->uninstall().
(e) netdev_nl_sock_priv_destroy() accesses struct net_device to acquire
netdev_lock().
But if the interface module has already been removed, net_device
pointer is invalid, so it causes kernel panic.
In summary, there are only 3 possible scenarios.
A. sk close -> pp destroy -> uninstall.
B. pp destroy -> sk close -> uninstall.
C. pp destroy -> uninstall -> sk close.
Case C is a kernel panic scenario.
In order to fix this problem, It makes mp_dmabuf_devmem_uninstall() set
binding->dev to NULL.
It indicates an bound net_device was unregistered.
It makes netdev_nl_sock_priv_destroy() do not acquire netdev_lock()
if binding->dev is NULL.
A new binding->lock is added to protect a dev of a binding.
So, lock ordering is like below.
priv->lock
netdev_lock(dev)
binding->lock
Tests:
Scenario A:
./ncdevmem -s 192.168.1.4 -c 192.168.1.2 -f $interface -l -p 8000 \
-v 7 -t 1 -q 1 &
pid=$!
sleep 10
kill $pid
ip link set $interface down
modprobe -rv $module
Scenario B:
./ncdevmem -s 192.168.1.4 -c 192.168.1.2 -f $interface -l -p 8000 \
-v 7 -t 1 -q 1 &
pid=$!
sleep 10
ip link set $interface down
kill $pid
modprobe -rv $module
Scenario C:
./ncdevmem -s 192.168.1.4 -c 192.168.1.2 -f $interface -l -p 8000 \
-v 7 -t 1 -q 1 &
pid=$!
sleep 10
modprobe -rv $module
sleep 5
kill $pid
Splat looks like:
Oops: general protection fault, probably for non-canonical address 0xdffffc001fffa9f7: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI
KASAN: probably user-memory-access in range [0x00000000fffd4fb8-0x00000000fffd4fbf]
CPU: 0 UID: 0 PID: 2041 Comm: ncdevmem Tainted: G B W 6.15.0-rc1+ #2 PREEMPT(undef) 0947ec89efa0fd68838b78e36aa1617e97ff5d7f
Tainted: [B]=BAD_PAGE, [W]=WARN
RIP: 0010:__mutex_lock (./include/linux/sched.h:2244 kernel/locking/mutex.c:400 kernel/locking/mutex.c:443 kernel/locking/mutex.c:605 kernel/locking/mutex.c:746)
Code: ea 03 80 3c 02 00 0f 85 4f 13 00 00 49 8b 1e 48 83 e3 f8 74 6a 48 b8 00 00 00 00 00 fc ff df 48 8d 7b 34 48 89 fa 48 c1 ea 03 <0f> b6 f
RSP: 0018:ffff88826f7ef730 EFLAGS: 00010203
RAX: dffffc0000000000 RBX: 00000000fffd4f88 RCX: ffffffffaa9bc811
RDX: 000000001fffa9f7 RSI: 0000000000000008 RDI: 00000000fffd4fbc
RBP: ffff88826f7ef8b0 R08: 0000000000000000 R09: ffffed103e6aa1a4
R10: 0000000000000007 R11: ffff88826f7ef442 R12: fffffbfff669f65e
R13: ffff88812a830040 R14: ffff8881f3550d20 R15: 00000000fffd4f88
FS: 0000000000000000(0000) GS:ffff888866c05000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000563bed0cb288 CR3: 00000001a7c98000 CR4: 00000000007506f0
PKRU: 55555554
Call Trace:
<TASK>
...
netdev_nl_sock_priv_destroy (net/core/netdev-genl.c:953 (discriminator 3))
genl_release (net/netlink/genetlink.c:653 net/netlink/genetlink.c:694 net/netlink/genetlink.c:705)
...
netlink_release (net/netlink/af_netlink.c:737)
...
__sock_release (net/socket.c:647)
sock_close (net/socket.c:1393)
Fixes: 1d22d3060b ("net: drop rtnl_lock for queue_mgmt operations")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Acked-by: Stanislav Fomichev <sdf@fomichev.me>
Link: https://patch.msgid.link/20250514154028.1062909-1-ap420073@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
402 lines
9.9 KiB
C
402 lines
9.9 KiB
C
// SPDX-License-Identifier: GPL-2.0-or-later
|
|
/*
|
|
* Devmem TCP
|
|
*
|
|
* Authors: Mina Almasry <almasrymina@google.com>
|
|
* Willem de Bruijn <willemdebruijn.kernel@gmail.com>
|
|
* Kaiyuan Zhang <kaiyuanz@google.com
|
|
*/
|
|
|
|
#include <linux/dma-buf.h>
|
|
#include <linux/genalloc.h>
|
|
#include <linux/mm.h>
|
|
#include <linux/netdevice.h>
|
|
#include <linux/types.h>
|
|
#include <net/netdev_queues.h>
|
|
#include <net/netdev_rx_queue.h>
|
|
#include <net/page_pool/helpers.h>
|
|
#include <net/page_pool/memory_provider.h>
|
|
#include <trace/events/page_pool.h>
|
|
|
|
#include "devmem.h"
|
|
#include "mp_dmabuf_devmem.h"
|
|
#include "page_pool_priv.h"
|
|
|
|
/* Device memory support */
|
|
|
|
static DEFINE_XARRAY_FLAGS(net_devmem_dmabuf_bindings, XA_FLAGS_ALLOC1);
|
|
|
|
static const struct memory_provider_ops dmabuf_devmem_ops;
|
|
|
|
bool net_is_devmem_iov(struct net_iov *niov)
|
|
{
|
|
return niov->pp->mp_ops == &dmabuf_devmem_ops;
|
|
}
|
|
|
|
static void net_devmem_dmabuf_free_chunk_owner(struct gen_pool *genpool,
|
|
struct gen_pool_chunk *chunk,
|
|
void *not_used)
|
|
{
|
|
struct dmabuf_genpool_chunk_owner *owner = chunk->owner;
|
|
|
|
kvfree(owner->area.niovs);
|
|
kfree(owner);
|
|
}
|
|
|
|
static dma_addr_t net_devmem_get_dma_addr(const struct net_iov *niov)
|
|
{
|
|
struct dmabuf_genpool_chunk_owner *owner;
|
|
|
|
owner = net_devmem_iov_to_chunk_owner(niov);
|
|
return owner->base_dma_addr +
|
|
((dma_addr_t)net_iov_idx(niov) << PAGE_SHIFT);
|
|
}
|
|
|
|
void __net_devmem_dmabuf_binding_free(struct net_devmem_dmabuf_binding *binding)
|
|
{
|
|
size_t size, avail;
|
|
|
|
gen_pool_for_each_chunk(binding->chunk_pool,
|
|
net_devmem_dmabuf_free_chunk_owner, NULL);
|
|
|
|
size = gen_pool_size(binding->chunk_pool);
|
|
avail = gen_pool_avail(binding->chunk_pool);
|
|
|
|
if (!WARN(size != avail, "can't destroy genpool. size=%zu, avail=%zu",
|
|
size, avail))
|
|
gen_pool_destroy(binding->chunk_pool);
|
|
|
|
dma_buf_unmap_attachment_unlocked(binding->attachment, binding->sgt,
|
|
DMA_FROM_DEVICE);
|
|
dma_buf_detach(binding->dmabuf, binding->attachment);
|
|
dma_buf_put(binding->dmabuf);
|
|
xa_destroy(&binding->bound_rxqs);
|
|
kfree(binding);
|
|
}
|
|
|
|
struct net_iov *
|
|
net_devmem_alloc_dmabuf(struct net_devmem_dmabuf_binding *binding)
|
|
{
|
|
struct dmabuf_genpool_chunk_owner *owner;
|
|
unsigned long dma_addr;
|
|
struct net_iov *niov;
|
|
ssize_t offset;
|
|
ssize_t index;
|
|
|
|
dma_addr = gen_pool_alloc_owner(binding->chunk_pool, PAGE_SIZE,
|
|
(void **)&owner);
|
|
if (!dma_addr)
|
|
return NULL;
|
|
|
|
offset = dma_addr - owner->base_dma_addr;
|
|
index = offset / PAGE_SIZE;
|
|
niov = &owner->area.niovs[index];
|
|
|
|
niov->pp_magic = 0;
|
|
niov->pp = NULL;
|
|
atomic_long_set(&niov->pp_ref_count, 0);
|
|
|
|
return niov;
|
|
}
|
|
|
|
void net_devmem_free_dmabuf(struct net_iov *niov)
|
|
{
|
|
struct net_devmem_dmabuf_binding *binding = net_devmem_iov_binding(niov);
|
|
unsigned long dma_addr = net_devmem_get_dma_addr(niov);
|
|
|
|
if (WARN_ON(!gen_pool_has_addr(binding->chunk_pool, dma_addr,
|
|
PAGE_SIZE)))
|
|
return;
|
|
|
|
gen_pool_free(binding->chunk_pool, dma_addr, PAGE_SIZE);
|
|
}
|
|
|
|
void net_devmem_unbind_dmabuf(struct net_devmem_dmabuf_binding *binding)
|
|
{
|
|
struct netdev_rx_queue *rxq;
|
|
unsigned long xa_idx;
|
|
unsigned int rxq_idx;
|
|
|
|
if (binding->list.next)
|
|
list_del(&binding->list);
|
|
|
|
xa_for_each(&binding->bound_rxqs, xa_idx, rxq) {
|
|
const struct pp_memory_provider_params mp_params = {
|
|
.mp_priv = binding,
|
|
.mp_ops = &dmabuf_devmem_ops,
|
|
};
|
|
|
|
rxq_idx = get_netdev_rx_queue_index(rxq);
|
|
|
|
__net_mp_close_rxq(binding->dev, rxq_idx, &mp_params);
|
|
}
|
|
|
|
xa_erase(&net_devmem_dmabuf_bindings, binding->id);
|
|
|
|
net_devmem_dmabuf_binding_put(binding);
|
|
}
|
|
|
|
int net_devmem_bind_dmabuf_to_queue(struct net_device *dev, u32 rxq_idx,
|
|
struct net_devmem_dmabuf_binding *binding,
|
|
struct netlink_ext_ack *extack)
|
|
{
|
|
struct pp_memory_provider_params mp_params = {
|
|
.mp_priv = binding,
|
|
.mp_ops = &dmabuf_devmem_ops,
|
|
};
|
|
struct netdev_rx_queue *rxq;
|
|
u32 xa_idx;
|
|
int err;
|
|
|
|
err = __net_mp_open_rxq(dev, rxq_idx, &mp_params, extack);
|
|
if (err)
|
|
return err;
|
|
|
|
rxq = __netif_get_rx_queue(dev, rxq_idx);
|
|
err = xa_alloc(&binding->bound_rxqs, &xa_idx, rxq, xa_limit_32b,
|
|
GFP_KERNEL);
|
|
if (err)
|
|
goto err_close_rxq;
|
|
|
|
return 0;
|
|
|
|
err_close_rxq:
|
|
__net_mp_close_rxq(dev, rxq_idx, &mp_params);
|
|
return err;
|
|
}
|
|
|
|
struct net_devmem_dmabuf_binding *
|
|
net_devmem_bind_dmabuf(struct net_device *dev, unsigned int dmabuf_fd,
|
|
struct netlink_ext_ack *extack)
|
|
{
|
|
struct net_devmem_dmabuf_binding *binding;
|
|
static u32 id_alloc_next;
|
|
struct scatterlist *sg;
|
|
struct dma_buf *dmabuf;
|
|
unsigned int sg_idx, i;
|
|
unsigned long virtual;
|
|
int err;
|
|
|
|
dmabuf = dma_buf_get(dmabuf_fd);
|
|
if (IS_ERR(dmabuf))
|
|
return ERR_CAST(dmabuf);
|
|
|
|
binding = kzalloc_node(sizeof(*binding), GFP_KERNEL,
|
|
dev_to_node(&dev->dev));
|
|
if (!binding) {
|
|
err = -ENOMEM;
|
|
goto err_put_dmabuf;
|
|
}
|
|
|
|
binding->dev = dev;
|
|
|
|
err = xa_alloc_cyclic(&net_devmem_dmabuf_bindings, &binding->id,
|
|
binding, xa_limit_32b, &id_alloc_next,
|
|
GFP_KERNEL);
|
|
if (err < 0)
|
|
goto err_free_binding;
|
|
|
|
xa_init_flags(&binding->bound_rxqs, XA_FLAGS_ALLOC);
|
|
|
|
refcount_set(&binding->ref, 1);
|
|
|
|
mutex_init(&binding->lock);
|
|
|
|
binding->dmabuf = dmabuf;
|
|
|
|
binding->attachment = dma_buf_attach(binding->dmabuf, dev->dev.parent);
|
|
if (IS_ERR(binding->attachment)) {
|
|
err = PTR_ERR(binding->attachment);
|
|
NL_SET_ERR_MSG(extack, "Failed to bind dmabuf to device");
|
|
goto err_free_id;
|
|
}
|
|
|
|
binding->sgt = dma_buf_map_attachment_unlocked(binding->attachment,
|
|
DMA_FROM_DEVICE);
|
|
if (IS_ERR(binding->sgt)) {
|
|
err = PTR_ERR(binding->sgt);
|
|
NL_SET_ERR_MSG(extack, "Failed to map dmabuf attachment");
|
|
goto err_detach;
|
|
}
|
|
|
|
/* For simplicity we expect to make PAGE_SIZE allocations, but the
|
|
* binding can be much more flexible than that. We may be able to
|
|
* allocate MTU sized chunks here. Leave that for future work...
|
|
*/
|
|
binding->chunk_pool =
|
|
gen_pool_create(PAGE_SHIFT, dev_to_node(&dev->dev));
|
|
if (!binding->chunk_pool) {
|
|
err = -ENOMEM;
|
|
goto err_unmap;
|
|
}
|
|
|
|
virtual = 0;
|
|
for_each_sgtable_dma_sg(binding->sgt, sg, sg_idx) {
|
|
dma_addr_t dma_addr = sg_dma_address(sg);
|
|
struct dmabuf_genpool_chunk_owner *owner;
|
|
size_t len = sg_dma_len(sg);
|
|
struct net_iov *niov;
|
|
|
|
owner = kzalloc_node(sizeof(*owner), GFP_KERNEL,
|
|
dev_to_node(&dev->dev));
|
|
if (!owner) {
|
|
err = -ENOMEM;
|
|
goto err_free_chunks;
|
|
}
|
|
|
|
owner->area.base_virtual = virtual;
|
|
owner->base_dma_addr = dma_addr;
|
|
owner->area.num_niovs = len / PAGE_SIZE;
|
|
owner->binding = binding;
|
|
|
|
err = gen_pool_add_owner(binding->chunk_pool, dma_addr,
|
|
dma_addr, len, dev_to_node(&dev->dev),
|
|
owner);
|
|
if (err) {
|
|
kfree(owner);
|
|
err = -EINVAL;
|
|
goto err_free_chunks;
|
|
}
|
|
|
|
owner->area.niovs = kvmalloc_array(owner->area.num_niovs,
|
|
sizeof(*owner->area.niovs),
|
|
GFP_KERNEL);
|
|
if (!owner->area.niovs) {
|
|
err = -ENOMEM;
|
|
goto err_free_chunks;
|
|
}
|
|
|
|
for (i = 0; i < owner->area.num_niovs; i++) {
|
|
niov = &owner->area.niovs[i];
|
|
niov->owner = &owner->area;
|
|
page_pool_set_dma_addr_netmem(net_iov_to_netmem(niov),
|
|
net_devmem_get_dma_addr(niov));
|
|
}
|
|
|
|
virtual += len;
|
|
}
|
|
|
|
return binding;
|
|
|
|
err_free_chunks:
|
|
gen_pool_for_each_chunk(binding->chunk_pool,
|
|
net_devmem_dmabuf_free_chunk_owner, NULL);
|
|
gen_pool_destroy(binding->chunk_pool);
|
|
err_unmap:
|
|
dma_buf_unmap_attachment_unlocked(binding->attachment, binding->sgt,
|
|
DMA_FROM_DEVICE);
|
|
err_detach:
|
|
dma_buf_detach(dmabuf, binding->attachment);
|
|
err_free_id:
|
|
xa_erase(&net_devmem_dmabuf_bindings, binding->id);
|
|
err_free_binding:
|
|
kfree(binding);
|
|
err_put_dmabuf:
|
|
dma_buf_put(dmabuf);
|
|
return ERR_PTR(err);
|
|
}
|
|
|
|
/*** "Dmabuf devmem memory provider" ***/
|
|
|
|
int mp_dmabuf_devmem_init(struct page_pool *pool)
|
|
{
|
|
struct net_devmem_dmabuf_binding *binding = pool->mp_priv;
|
|
|
|
if (!binding)
|
|
return -EINVAL;
|
|
|
|
/* dma-buf dma addresses do not need and should not be used with
|
|
* dma_sync_for_cpu/device. Force disable dma_sync.
|
|
*/
|
|
pool->dma_sync = false;
|
|
pool->dma_sync_for_cpu = false;
|
|
|
|
if (pool->p.order != 0)
|
|
return -E2BIG;
|
|
|
|
net_devmem_dmabuf_binding_get(binding);
|
|
return 0;
|
|
}
|
|
|
|
netmem_ref mp_dmabuf_devmem_alloc_netmems(struct page_pool *pool, gfp_t gfp)
|
|
{
|
|
struct net_devmem_dmabuf_binding *binding = pool->mp_priv;
|
|
struct net_iov *niov;
|
|
netmem_ref netmem;
|
|
|
|
niov = net_devmem_alloc_dmabuf(binding);
|
|
if (!niov)
|
|
return 0;
|
|
|
|
netmem = net_iov_to_netmem(niov);
|
|
|
|
page_pool_set_pp_info(pool, netmem);
|
|
|
|
pool->pages_state_hold_cnt++;
|
|
trace_page_pool_state_hold(pool, netmem, pool->pages_state_hold_cnt);
|
|
return netmem;
|
|
}
|
|
|
|
void mp_dmabuf_devmem_destroy(struct page_pool *pool)
|
|
{
|
|
struct net_devmem_dmabuf_binding *binding = pool->mp_priv;
|
|
|
|
net_devmem_dmabuf_binding_put(binding);
|
|
}
|
|
|
|
bool mp_dmabuf_devmem_release_page(struct page_pool *pool, netmem_ref netmem)
|
|
{
|
|
long refcount = atomic_long_read(netmem_get_pp_ref_count_ref(netmem));
|
|
|
|
if (WARN_ON_ONCE(!netmem_is_net_iov(netmem)))
|
|
return false;
|
|
|
|
if (WARN_ON_ONCE(refcount != 1))
|
|
return false;
|
|
|
|
page_pool_clear_pp_info(netmem);
|
|
|
|
net_devmem_free_dmabuf(netmem_to_net_iov(netmem));
|
|
|
|
/* We don't want the page pool put_page()ing our net_iovs. */
|
|
return false;
|
|
}
|
|
|
|
static int mp_dmabuf_devmem_nl_fill(void *mp_priv, struct sk_buff *rsp,
|
|
struct netdev_rx_queue *rxq)
|
|
{
|
|
const struct net_devmem_dmabuf_binding *binding = mp_priv;
|
|
int type = rxq ? NETDEV_A_QUEUE_DMABUF : NETDEV_A_PAGE_POOL_DMABUF;
|
|
|
|
return nla_put_u32(rsp, type, binding->id);
|
|
}
|
|
|
|
static void mp_dmabuf_devmem_uninstall(void *mp_priv,
|
|
struct netdev_rx_queue *rxq)
|
|
{
|
|
struct net_devmem_dmabuf_binding *binding = mp_priv;
|
|
struct netdev_rx_queue *bound_rxq;
|
|
unsigned long xa_idx;
|
|
|
|
xa_for_each(&binding->bound_rxqs, xa_idx, bound_rxq) {
|
|
if (bound_rxq == rxq) {
|
|
xa_erase(&binding->bound_rxqs, xa_idx);
|
|
if (xa_empty(&binding->bound_rxqs)) {
|
|
mutex_lock(&binding->lock);
|
|
binding->dev = NULL;
|
|
mutex_unlock(&binding->lock);
|
|
}
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
|
|
static const struct memory_provider_ops dmabuf_devmem_ops = {
|
|
.init = mp_dmabuf_devmem_init,
|
|
.destroy = mp_dmabuf_devmem_destroy,
|
|
.alloc_netmems = mp_dmabuf_devmem_alloc_netmems,
|
|
.release_netmem = mp_dmabuf_devmem_release_page,
|
|
.nl_fill = mp_dmabuf_devmem_nl_fill,
|
|
.uninstall = mp_dmabuf_devmem_uninstall,
|
|
};
|