Skip to content
  • Bruce Allan's avatar
    e1000e: DoS while TSO enabled caused by link partner with small MSS · d821a4c4
    Bruce Allan authored
    
    
    With a low enough MSS on the link partner and TSO enabled locally, the
    networking stack can periodically send a very large (e.g.  64KB) TCP
    message for which the driver will attempt to use more Tx descriptors than
    are available by default in the Tx ring.  This is due to a workaround in
    the code that imposes a limit of only 4 MSS-sized segments per descriptor
    which appears to be a carry-over from the older e1000 driver and may be
    applicable only to some older PCI or PCIx parts which are not supported in
    e1000e.  When the driver gets a message that is too large to fit across the
    configured number of Tx descriptors, it stops the upper stack from queueing
    any more and gets stuck in this state.  After a timeout, the upper stack
    assumes the adapter is hung and calls the driver to reset it.
    
    Remove the unnecessary limitation of using up to only 4 MSS-sized segments
    per Tx descriptor, and put in a hard failure test to catch when attempting
    to check for message sizes larger than would fit in the whole Tx ring.
    Refactor the remaining logic that limits the size of data per Tx descriptor
    from a seemingly arbitrary 8KB to a limit based on the dynamic size of the
    Tx packet buffer as described in the hardware specification.
    
    Also, fix the logic in the check for space in the Tx ring for the next
    largest possible packet after the current one has been successfully queued
    for transmit, and use the appropriate defines for default ring sizes in
    e1000_probe instead of magic values.
    
    This issue goes back to the introduction of e1000e in 2.6.24 when it was
    split off from e1000.
    
    Reported-by: default avatarBen Hutchings <bhutchings@solarflare.com>
    Signed-off-by: default avatarBruce Allan <bruce.w.allan@intel.com>
    Cc: Stable <stable@vger.kernel.org> [2.6.24+]
    Tested-by: default avatarAaron Brown <aaron.f.brown@intel.com>
    Signed-off-by: default avatarJeff Kirsher <jeffrey.t.kirsher@intel.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    d821a4c4