diff options
| author | Michael Chan <michael.chan@broadcom.com> | 2021-10-25 05:05:28 -0400 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2021-11-02 19:48:22 +0100 |
| commit | 2b7c5eed19d3009dd6cca36853b3a22d7eff9209 (patch) | |
| tree | 1f3c6eb8feb424f05288872a2d4c5ca2a3835763 /net/core | |
| parent | 04121b10cdf0361c0fac761a9264659935878693 (diff) | |
| download | linux-stable-2b7c5eed19d3009dd6cca36853b3a22d7eff9209.tar.gz linux-stable-2b7c5eed19d3009dd6cca36853b3a22d7eff9209.tar.bz2 linux-stable-2b7c5eed19d3009dd6cca36853b3a22d7eff9209.zip | |
net: Prevent infinite while loop in skb_tx_hash()
commit 0c57eeecc559ca6bc18b8c4e2808bc78dbe769b0 upstream.
Drivers call netdev_set_num_tc() and then netdev_set_tc_queue()
to set the queue count and offset for each TC. So the queue count
and offset for the TCs may be zero for a short period after dev->num_tc
has been set. If a TX packet is being transmitted at this time in the
code path netdev_pick_tx() -> skb_tx_hash(), skb_tx_hash() may see
nonzero dev->num_tc but zero qcount for the TC. The while loop that
keeps looping while hash >= qcount will not end.
Fix it by checking the TC's qcount to be nonzero before using it.
Fixes: eadec877ce9c ("net: Add support for subordinate traffic classes to netdev_pick_tx")
Reviewed-by: Andy Gospodarek <gospo@broadcom.com>
Signed-off-by: Michael Chan <michael.chan@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net/core')
| -rw-r--r-- | net/core/dev.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/net/core/dev.c b/net/core/dev.c index b9d19fbb1589..6a4e0e3c59fe 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -3171,6 +3171,12 @@ static u16 skb_tx_hash(const struct net_device *dev, qoffset = sb_dev->tc_to_txq[tc].offset; qcount = sb_dev->tc_to_txq[tc].count; + if (unlikely(!qcount)) { + net_warn_ratelimited("%s: invalid qcount, qoffset %u for tc %u\n", + sb_dev->name, qoffset, tc); + qoffset = 0; + qcount = dev->real_num_tx_queues; + } } if (skb_rx_queue_recorded(skb)) { |