netdev - Re: [PATCH] net/mlx4_en: ensure rx_desc updating reaches HW before prod db updating

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 19 Jan 2018 07:49:59 -0800
From:   Eric Dumazet <eric.dumazet@...il.com>
To:     "jianchao.wang" <jianchao.w.wang@...cle.com>,
        Tariq Toukan <tariqt@...lanox.com>,
        Jason Gunthorpe <jgg@...pe.ca>
Cc:     junxiao.bi@...cle.com, netdev@...r.kernel.org,
        linux-rdma@...r.kernel.org, linux-kernel@...r.kernel.org,
        Saeed Mahameed <saeedm@...lanox.com>
Subject: Re: [PATCH] net/mlx4_en: ensure rx_desc updating reaches HW before
 prod db updating

On Fri, 2018-01-19 at 23:16 +0800, jianchao.wang wrote:
> Hi Tariq
> 
> Very sad that the crash was reproduced again after applied the patch.
> 
> --- a/drivers/net/ethernet/mellanox/mlx4/en_rx.c
> +++ b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
> @@ -252,6 +252,7 @@ static inline bool mlx4_en_is_ring_empty(struct mlx4_en_rx_ring *ring)
>  
>  static inline void mlx4_en_update_rx_prod_db(struct mlx4_en_rx_ring *ring)
>  {
> +	dma_wmb();

So... is wmb() here fixing the issue ?

>  	*ring->wqres.db.db = cpu_to_be32(ring->prod & 0xffff);
>  }
> 
> I analyzed the kdump, it should be a memory corruption.
> 
> Thanks
> Jianchao
> On 01/15/2018 01:50 PM, jianchao.wang wrote:
> > Hi Tariq
> > 
> > Thanks for your kindly response.
> > 
> > On 01/14/2018 05:47 PM, Tariq Toukan wrote:
> > > Thanks Jianchao for your patch.
> > > 
> > > And Thank you guys for your reviews, much appreciated.
> > > I was off-work on Friday and Saturday.
> > > 
> > > On 14/01/2018 4:40 AM, jianchao.wang wrote:
> > > > Dear all
> > > > 
> > > > Thanks for the kindly response and reviewing. That's really appreciated.
> > > > 
> > > > On 01/13/2018 12:46 AM, Eric Dumazet wrote:
> > > > > > Does this need to be dma_wmb(), and should it be in
> > > > > > mlx4_en_update_rx_prod_db ?
> > > > > > 
> > > > > 
> > > > > +1 on dma_wmb()
> > > > > 
> > > > > On what architecture bug was observed ?
> > > > 
> > > > This issue was observed on x86-64.
> > > > And I will send a new patch, in which replace wmb() with dma_wmb(), to customer
> > > > to confirm.
> > > 
> > > +1 on dma_wmb, let us know once customer confirms.
> > > Please place it within mlx4_en_update_rx_prod_db as suggested.
> > 
> > Yes, I have recommended it to customer.
> > Once I get the result, I will share it here.
> > > All other calls to mlx4_en_update_rx_prod_db are in control/slow path so I prefer being on the safe side, and care less about bulking the barrier.
> > > 
> > > Thanks,
> > > Tariq
> > >