linux-kernel - Re: [PATCH v4] net: hisilicon: Fix a BUG trigered by wrong bytes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20191220.211543.940622133336540668.davem@davemloft.net>
Date:   Fri, 20 Dec 2019 21:15:43 -0800 (PST)
From:   David Miller <davem@...emloft.net>
To:     xiaojiangfeng@...wei.com
Cc:     yisen.zhuang@...wei.com, salil.mehta@...wei.com,
        zhangfei.gao@...aro.org, arnd@...db.de, dingtianhong@...wei.com,
        netdev@...r.kernel.org, linux-kernel@...r.kernel.org,
        jakub.kicinski@...ronome.com, leeyou.li@...wei.com,
        nixiaoming@...wei.com
Subject: Re: [PATCH v4] net: hisilicon: Fix a BUG trigered by wrong
 bytes_compl

From: Jiangfeng Xiao <xiaojiangfeng@...wei.com>
Date: Thu, 19 Dec 2019 10:08:07 +0800

> When doing stress test, we get the following trace:
 ...
> Pre-modification code:
> int hip04_mac_start_xmit(struct sk_buff *skb, struct net_device *ndev)
> {
> [...]
> [1]	priv->tx_head = TX_NEXT(tx_head);
> [2]	count++;
> [3]	netdev_sent_queue(ndev, skb->len);
> [...]
> }
> An rx interrupt occurs if hip04_mac_start_xmit just executes to the line 2,
> tx_head has been updated, but corresponding 'skb->len' has not been
> added to dql_queue.
> 
> And then
> hip04_mac_interrupt->__napi_schedule->hip04_rx_poll->hip04_tx_reclaim
> 
> In hip04_tx_reclaim, because tx_head has been updated,
> bytes_compl will plus an additional "skb-> len"
> which has not been added to dql_queue. And then
> trigger the BUG_ON(bytes_compl > num_queued - dql->num_completed).
> 
> To solve the problem described above, we put
> "netdev_sent_queue(ndev, skb->len);"
> before
> "priv->tx_head = TX_NEXT(tx_head);"
> 
> Fixes: a41ea46a9a12 ("net: hisilicon: new hip04 ethernet driver")
> Signed-off-by: Jiangfeng Xiao <xiaojiangfeng@...wei.com>

Applied, thanks.