netdev - Re: Commit 05cf0d1bf4 ("net: stmmac: free an skb first when there are no longer any descriptors using it") breaks stmmac?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 16 Feb 2018 09:34:39 +0000
From:   Jose Abreu <Jose.Abreu@...opsys.com>
To:     Niklas Cassel <niklas.cassel@...s.com>,
        Niklas Cassel <niklass@...s.com>,
        Jose Abreu <Jose.Abreu@...opsys.com>
CC:     Joao Pinto <Joao.Pinto@...opsys.com>,
        linux-netdev <netdev@...r.kernel.org>,
        Giuseppe CAVALLARO <peppe.cavallaro@...com>,
        <alexandre.torgue@...com>
Subject: Re: Commit 05cf0d1bf4 ("net: stmmac: free an skb first when there are
 no longer any descriptors using it") breaks stmmac?

Hi Niklas,

Thank you for looking into this!

On 13-02-2018 13:33, Niklas Cassel wrote:
> Hello Jose,
>
>
> I remember that you had a problem
> with a use after free in stmmac_tx_clean().
> I still don't think that it is related to
> commit 05cf0d1bf4, however, when comparing
> the stmmac driver to the amd-xgbe driver
> I realized that:
>
> xgbe_tx_poll() has both a smp_rmb() after fetching
> cur_tx, and also a dma_rmb() after reading the own
> bit, before reading any other descriptor fields.
>
> stmmac_tx_clean() has neither a smp_rmb() or a
> dma_rmb().
>
>
> Also
> xgbe_dev_xmit() has a dma_wmb() _before_ setting
> the own bit, and a smp_wmb() after setting the own
> bit.
>
> stmmac simply has a dma_wmb() _after_ setting the
> own bit.
>
>
> I assume you are using a SMP system.

Yes.

>
> If you can still reproduce your problem quite easily,
> perhaps you could try to make stmmac look more like
> xgbe in these regards, and see if that solves your
> use after free crash in stmmac_tx_clean().

At the time it would be easily reproduced if I flooded the
interface. I will check xgbe barriers and check if it should also
be used in stmmac.

Thanks again!

Best Regards,
Jose Miguel Abreu

>
>
> Kind regards,
> Niklas