Bug 491786 - s2io should check inputs for rx_ring_sz
Summary: s2io should check inputs for rx_ring_sz
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: kernel
Version: 5.5
Hardware: All
OS: Linux
low
low
Target Milestone: rc
: ---
Assignee: Michal Schmidt
QA Contact: Network QE
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2009-03-24 02:59 UTC by Andrew Hecox
Modified: 2011-07-21 10:27 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2011-07-21 10:27:42 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2011:1065 0 normal SHIPPED_LIVE Important: Red Hat Enterprise Linux 5.7 kernel security and bug fix update 2011-07-21 09:21:37 UTC

Description Andrew Hecox 2009-03-24 02:59:04 UTC
for the s2io module, a large enough rx_ring_rz will attempt to claim all memory on the system. A stupid admin <cough, cough> might naively assume rx_ring_sz could take as input the output of ethtool -g's rx ring max. The tx_fifo_sz parameter works exactly this way.

The documentation points out that:

 d. rx_ring_sz
 Size of each receive ring(in 4K blocks)
 Valid range: Limited by memory on system

but this could be a a bit more ... expected. In the vary least, maybe check if the requested rx_ring_sz exceeds current physical memory.

eg:

ahecox@intel-bensley ~ $ sudo ethtool -g eth1
Ring parameters for eth1:
Pre-set maximums:
RX:             152400
RX Mini:        0
RX Jumbo:       152400
TX:             8192
Current hardware settings:
RX:             3840
RX Mini:        0
RX Jumbo:       3840
TX:             8192

ahecox@intel-bensley ~ $ sudo rmmod s2io
ahecox@intel-bensley ~ $ modinfo s2io | grep rx
parm:           rx_ring_num:uint
parm:           rx_ring_mode:uint
parm:           rxsync_frequency:uint
parm:           rx_ring_sz:array of uint
ahecox@intel-bensley ~ $ sudo modprobe s2io rx_ring_num=1 rx_ring_sz=152400

Message from syslogd@ at Mon Mar 23 22:48:32 2009 ...
intel-bensley kernel: Unable to handle kernel paging request at 000000011fbdd290 RIP: 
Message from syslogd@ at Mon Mar 23 22:48:32 2009 ...
intel-bensley kernel:  [<ffffffff80021bee>] dma_alloc_coherent+0x2d/0x1ca

Comment 1 Jan Tluka 2009-11-11 13:57:29 UTC
Andrew, if you think this is really a bug, please raise these flags: 
rhel‑5.5.0 ?
pm_ack ?
devel_ack ?
qa_ack +

Thanks.

Comment 2 Andrew Hecox 2010-01-06 11:54:31 UTC
set (I can't set qa_ack+)

Comment 4 Jon Mason 2010-09-02 22:18:02 UTC
There is a hard limit (due to array size) of the rx_ring_sz to 150 entries.  Currently, the driver will let any value be set, which can cause the memory corruption bug you are seeing.  I should have a fix pushed to mainline shortly.

Comment 5 RHEL Program Management 2011-02-01 17:06:04 UTC
This request was evaluated by Red Hat Product Management for inclusion in a Red
Hat Enterprise Linux maintenance release.  Product Management has requested
further review of this request by Red Hat Engineering, for potential
inclusion in a Red Hat Enterprise Linux Update release for currently deployed
products.  This request is not yet committed for inclusion in an Update
release.

Comment 7 Qian Cai 2011-02-18 01:49:58 UTC
Where are the patches upstream for this to inspect?

Comment 8 Michal Schmidt 2011-02-18 14:02:07 UTC
(In reply to comment #7)
> Where are the patches upstream for this to inspect?

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=1853e2e15dc95ff3430530941b5856581251ef70

Comment 15 Jarod Wilson 2011-03-23 21:42:58 UTC
Patch(es) available in kernel-2.6.18-250.el5
Detailed testing feedback is always welcomed.

Comment 19 errata-xmlrpc 2011-07-21 10:27:42 UTC
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2011-1065.html


Note You need to log in before you can comment on or make changes to this bug.