linux-kernel - [PATCH net] bnxt_en: Fix potential race condition in bnxt_tx

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <1468626125-31732-1-git-send-email-f.fainelli@gmail.com>
Date:	Fri, 15 Jul 2016 16:42:01 -0700
From:	Florian Fainelli <f.fainelli@...il.com>
To:	netdev@...r.kernel.org
Cc:	davem@...emloft.net, Florian Fainelli <f.fainelli@...il.com>,
	Michael Chan <michael.chan@...adcom.com>,
	Jeffrey Huang <huangjw@...adcom.com>,
	linux-kernel@...r.kernel.org (open list)
Subject: [PATCH net] bnxt_en: Fix potential race condition in bnxt_tx_enable()

txr->dev_state is always manipulated after acquiring the transmit queue
lock, except in bnxt_tx_enable(), which seems suspicious here, so also
acquire the transmit queue lock before changing the value.

Reported-by: coverity (CID 1339583)
Fixes: c0c050c58d840 ("bnxt_en: New Broadcom ethernet driver.")
Signed-off-by: Florian Fainelli <f.fainelli@...il.com>
---
 drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
index c777cde85ce4..904c2a8ece12 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
@@ -4599,7 +4599,9 @@ static void bnxt_tx_enable(struct bnxt *bp)
 	for (i = 0; i < bp->tx_nr_rings; i++) {
 		txr = &bp->tx_ring[i];
 		txq = netdev_get_tx_queue(bp->dev, i);
+		__netif_tx_lock(txq, smp_processor_id());
 		txr->dev_state = 0;
+		__netif_tx_unlock(txq);
 	}
 	netif_tx_wake_all_queues(bp->dev);
 	if (bp->link_info.link_up)
-- 
2.7.4