linux-kernel - [PATCH 3.16 296/305] net: macb: Fix race condition in driver when Rx frame is dropped

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 03 Feb 2019 14:45:08 +0100
From:   Ben Hutchings <ben@...adent.org.uk>
To:     linux-kernel@...r.kernel.org, stable@...r.kernel.org
CC:     akpm@...ux-foundation.org, Denis Kirjanov <kda@...ux-powerpc.org>,
        "Punnaiah Choudary Kalluri" <punnaiah.choudary.kalluri@...inx.com>,
        "Punnaiah Choudary Kalluri" <punnaia@...inx.com>,
        "David S. Miller" <davem@...emloft.net>
Subject: [PATCH 3.16 296/305] net: macb: Fix race condition in driver when
 Rx frame is dropped

3.16.63-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Punnaiah Choudary Kalluri <punnaiah.choudary.kalluri@...inx.com>

commit d4c216c54197d741ed8b7ca54f13645dfb3eacde upstream.

Under heavy Rx load, observed that the Hw is updating the USED bit
and it is not updating the received frame status to the BD control
field. This could be lack of resources for processing the BDs at high
data rates. Driver drops the frame associated with this BD but not
clearing the USED bit. So, this is causing hang condition as Hw
expects USED bit to be cleared for this BD.

Signed-off-by: Punnaiah Choudary Kalluri <punnaia@...inx.com>
Signed-off-by: David S. Miller <davem@...emloft.net>
Signed-off-by: Ben Hutchings <ben@...adent.org.uk>
---
 drivers/net/ethernet/cadence/macb.c | 3 +++
 1 file changed, 3 insertions(+)

--- a/drivers/net/ethernet/cadence/macb.c
+++ b/drivers/net/ethernet/cadence/macb.c
@@ -634,6 +634,9 @@ static void gem_rx_refill(struct macb *b
 
 			/* properly align Ethernet header */
 			skb_reserve(skb, NET_IP_ALIGN);
+		} else {
+			bp->rx_ring[entry].addr &= ~MACB_BIT(RX_USED);
+			bp->rx_ring[entry].ctrl = 0;
 		}
 	}