netdev - r8152: data corruption in various scenarios

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sat, 5 Jan 2019 09:14:21 -0500
From:   Mark Lord <mlord@...ox.com>
To:     Ansis Atteka <aatteka@...ira.com>,
        Hayes Wang <hayeswang@...ltek.com>
Cc:     David Miller <davem@...emloft.net>,
        "greg@...ah.com" <greg@...ah.com>,
        "romieu@...zoreil.com" <romieu@...zoreil.com>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
        nic_swsd <nic_swsd@...ltek.com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "linux-usb@...r.kernel.org" <linux-usb@...r.kernel.org>,
        Kai-Heng Feng <kai.heng.feng@...onical.com>
Subject: r8152: data corruption in various scenarios

A couple of years back, I reported data corruption resulting from
a change in kernel 3.16 which enabled hardware checksums in the r8152 driver.
This was happening on an embedded system that was using a r8152 USB dongle.

At the time, it was very difficult to figure out what could possibly be causing it,
other than that re-enabling software checksums prevented corrupted packets from
resulting in more serious issues.

Since that time, more and more reports of similar corruption and issues
have been trickling in.  Eg.

   https://lore.kernel.org/patchwork/patch/873920/

Note that there are reports in the thread above that the issues
are not limited to only the built-in ethernet chip of the dock.

There is even now a special hack in the upstream r8152.c to attempt to detect
a Dell TB16 dock and disable RX Aggregation in the driver to prevent such issues.

Well.. I have a WD15 dock, not a TB16, and that same hack also catches my dock
in its net:

    [5.794641] usb 4-1.2: Dell TB16 Dock, disable RX aggregation

So one issue is that the code is not correctly identifying the dock,
and the WD15 is claimed to be immune from the r8152 issues.

One of the symptoms of the r8152 issue, reported by Ansis Atteka,
were messages like this:

   xhci_hcd 0000:39:00.0: ERROR Transfer event TRB DMA ptr not part of current TD ep_index 13
comp_code 1

I just got that exact message above, with the r8152 in my 1-day old WD15 dock,
with the TB16 "workaround" enabled in Linux kernel 4.20.0.

>From this I conclude that the workaround is not 100% complete yet.
-- 
Mark Lord
Real-Time Remedies Inc.
mlord@...ox.com