netdev - Re: [PATCH 1/1] bnx2x: fix slowpath null crash

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Wed, 8 Nov 2017 10:12:48 +0800
From:   Yanjun Zhu <yanjun.zhu@...cle.com>
To:     root <root@...pfan.cn.oracle.com>, ariel.elior@...ium.com,
        everest-linux-l2@...ium.com, netdev@...r.kernel.org
Cc:     Joe Jin <joe.jin@...cle.com>, Junxiao Bi <junxiao.bi@...cle.com>
Subject: Re: [PATCH 1/1] bnx2x: fix slowpath null crash

Please ignore this mail.

Zhu Yanjun


On 2017/11/8 9:58, root wrote:
> From: Zhu Yanjun <yanjun.zhu@...cle.com>
>
> When "NETDEV WATCHDOG: em4 (bnx2x): transmit queue 2 timed out" occurs,
> BNX2X_SP_RTNL_TX_TIMEOUT is set. In the function bnx2x_sp_rtnl_task,
> bnx2x_nic_unload and bnx2x_nic_load are executed to shutdown and open
> NIC. In the function bnx2x_nic_load, bnx2x_alloc_mem allocates dma
> failure. The message "bnx2x: [bnx2x_alloc_mem:8399(em4)]Can't
> allocate memory" pops out. The variable slowpath is set to NULL.
> When shutdown the NIC, the function bnx2x_nic_unload is called. In
> the function bnx2x_nic_unload, the following functions are executed.
> bnx2x_chip_cleanup
>      bnx2x_set_storm_rx_mode
>          bnx2x_set_q_rx_mode
>              bnx2x_set_q_rx_mode
>                  bnx2x_config_rx_mode
>                      bnx2x_set_rx_mode_e2
> In the function bnx2x_set_rx_mode_e2, the variable slowpath is operated.
> Then the crash occurs.
> To fix this crash, the variable slowpath is checked. And in the function
> bnx2x_sp_rtnl_task, after dma memory allocation fails, another shutdown
> and open NIC is executed.
>
> CC: Joe Jin <joe.jin@...cle.com>
> CC: Junxiao Bi <junxiao.bi@...cle.com>
> Signed-off-by: Zhu Yanjun <yanjun.zhu@...cle.com>
> ---
>   drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 14 +++++++++++---
>   1 file changed, 11 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
> index c12b4d3..5929324 100644
> --- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
> +++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
> @@ -9332,7 +9332,7 @@ void bnx2x_chip_cleanup(struct bnx2x *bp, int unload_mode, bool keep_link)
>   	/* Schedule the rx_mode command */
>   	if (test_bit(BNX2X_FILTER_RX_MODE_PENDING, &bp->sp_state))
>   		set_bit(BNX2X_FILTER_RX_MODE_SCHED, &bp->sp_state);
> -	else
> +	else if (!bp->slowpath)
>   		bnx2x_set_storm_rx_mode(bp);
>   
>   	/* Cleanup multicast configuration */
> @@ -10271,8 +10271,16 @@ static void bnx2x_sp_rtnl_task(struct work_struct *work)
>   		smp_mb();
>   
>   		bnx2x_nic_unload(bp, UNLOAD_NORMAL, true);
> -		bnx2x_nic_load(bp, LOAD_NORMAL);
> -
> +		/*When ret value shows failure of allocation failure,
> +		 *the nic is rebooted again. If open still fails, a error
> +		 *message to notify the user.
> +		 */
> +		if (bnx2x_nic_load(bp, LOAD_NORMAL) == -ENOMEM) {
> +			bnx2x_nic_unload(bp, UNLOAD_NORMAL, true);
> +			if (bnx2x_nic_load(bp, LOAD_NORMAL)) {
> +				BNX2X_ERR("Open the NIC fails again!\n");
> +			}
> +		}
>   		rtnl_unlock();
>   		return;
>   	}