netdev - Re: [PATCH] atl1: fix oops when changing tx/rx ring params

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 5 Jan 2011 16:42:17 +0100
From:	Luca Tettamanti <kronos.it@...il.com>
To:	"J. K. Cliburn" <jcliburn@...il.com>
Cc:	David Miller <davem@...emloft.net>, netdev@...r.kernel.org,
	stable@...nel.org, jussuf@...ux.ee, chris.snook@...il.com,
	Xiong.Huang@...eros.com
Subject: Re: [PATCH] atl1: fix oops when changing tx/rx ring params

On Sat, Jan 1, 2011 at 4:02 PM, J. K. Cliburn <jcliburn@...il.com> wrote:
> Commit 3f5a2a713aad28480d86b0add00c68484b54febc zeroes out the statistics
> message block (SMB) and coalescing message block (CMB) when adapter ring
> resources are freed.  This is desirable behavior, but, as a side effect,
> the commit leads to an oops when atl1_set_ringparam() attempts to alter
> the number of rx or tx elements in the ring buffer (by using ethtool
> -G, for example).  We don't want SMB or CMB to change during this
> operation.
>
> Modify atl1_set_ringparam() to preserve SMB and CMB when changing ring
> parameters.
>
> Cc: stable@...nel.org
> Signed-off-by: Jay Cliburn <jcliburn@...il.com>
> Reported-by: Tõnu Raitviir <jussuf@...ux.ee>
> ---
>  drivers/net/atlx/atl1.c |   10 ++++++++++
>  1 files changed, 10 insertions(+), 0 deletions(-)
>
> diff --git a/drivers/net/atlx/atl1.c b/drivers/net/atlx/atl1.c
> index 5336310..3acf512 100644
> --- a/drivers/net/atlx/atl1.c
> +++ b/drivers/net/atlx/atl1.c
> @@ -3504,6 +3504,8 @@ static int atl1_set_ringparam(struct net_device *netdev,
>        struct atl1_rfd_ring rfd_old, rfd_new;
>        struct atl1_rrd_ring rrd_old, rrd_new;
>        struct atl1_ring_header rhdr_old, rhdr_new;
> +       struct atl1_smb smb;
> +       struct atl1_cmb cmb;
>        int err;
>
>        tpd_old = adapter->tpd_ring;
> @@ -3544,11 +3546,19 @@ static int atl1_set_ringparam(struct net_device *netdev,
>                adapter->rrd_ring = rrd_old;
>                adapter->tpd_ring = tpd_old;
>                adapter->ring_header = rhdr_old;
> +               /*
> +                * Save SMB and CMB, since atl1_free_ring_resources
> +                * will clear them.
> +                */
> +               smb = adapter->smb;
> +               cmb = adapter->cmb;
>                atl1_free_ring_resources(adapter);

Hum, unless I'm missing something atl1_free_ring_resources frees the
whole ring_header->dma block which contains both SMB and CMB.

>                adapter->rfd_ring = rfd_new;
>                adapter->rrd_ring = rrd_new;
>                adapter->tpd_ring = tpd_new;
>                adapter->ring_header = rhdr_new;
> +               adapter->smb = smb;
> +               adapter->cmb = cmb;

So here you're using pointers to freed memory.
In order to preserve the stats you'd have to copy the structure.

Luca
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html