linux-kernel - Re: [PATCH net 2/2] net/smc: Don't use RMBs not mapped to new link in SMCRv2 ADD LINK

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Thu, 1 Jun 2023 16:37:42 +0800
From:   Wen Gu <guwen@...ux.alibaba.com>
To:     Wenjia Zhang <wenjia@...ux.ibm.com>, kgraul@...ux.ibm.com,
        jaka@...ux.ibm.com, davem@...emloft.net, edumazet@...gle.com,
        kuba@...nel.org, pabeni@...hat.com
Cc:     linux-s390@...r.kernel.org, netdev@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH net 2/2] net/smc: Don't use RMBs not mapped to new link in
 SMCRv2 ADD LINK



On 2023/5/31 04:34, Wenjia Zhang wrote:
> 
> 
> 
> Hi Wen,
> 
> Sorry for the late answer because of the public holiday here!
> 
> I really like the test scenario, thank you for the elaboration and the fixes!
> They look good to me.
> 
> Why I asked that was that the first patch looked very reasonable, but I was wondering why I didn't meet any problem with 
> that before ;-) and if it would trigger some problem during processing the SMCRv1 ADD Link Continuation Messages. After 
> checking the code again, I don't think there would be any problem with the patch, because in the case of processing the 
> SMCRv1 ADD Link Continuation Messages, it's about the same RMB.
> 
> Hi @Paolo, I would appreciate it if you could give us more time to review and test the patches. Because we have to make 
> sure that they can work on our platform (s390) without problem, not only on x86.
> 
> Thanks
> Wenjia
> 
> 

Inspired by your comments, I check the SMCRv1 and find it has the similar issue in smc_llc_add_link_cont().
The cause and way to reproduce it are similar to the issue in SMCRv2. I will fix this as well.

[  361.813390] BUG: kernel NULL pointer dereference, address: 0000000000000014
[  361.814121] #PF: supervisor read access in kernel mode
[  361.814646] #PF: error_code(0x0000) - not-present page
[  361.815160] PGD 0 P4D 0
[  361.815431] Oops: 0000 [#1] PREEMPT SMP PTI
[  361.815866] CPU: 5 PID: 48 Comm: kworker/5:0 Kdump: loaded Tainted: G        W   E      6.4.0-rc3+ #49
[  361.817952] Workqueue: events smc_llc_add_link_work [smc]
[  361.818527] RIP: 0010:smc_llc_add_link_cont+0x160/0x270 [smc]
[  361.820973] RSP: 0018:ffffa737801d3d50 EFLAGS: 00010286
[  361.821517] RAX: ffff964f82144000 RBX: ffffa737801d3dd8 RCX: 0000000000000000
[  361.822246] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff964f81370c30
[  361.822957] RBP: ffffa737801d3dd4 R08: ffff964f81370000 R09: ffffa737801d3db0
[  361.823678] R10: 0000000000000001 R11: 0000000000000060 R12: ffff964f82e70000
[  361.824409] R13: ffff964f81370c38 R14: ffffa737801d3dd3 R15: 0000000000000001
[  361.825119] FS:  0000000000000000(0000) GS:ffff9652bfd40000(0000) knlGS:0000000000000000
[  361.825934] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  361.826515] CR2: 0000000000000014 CR3: 000000008fa20004 CR4: 00000000003706e0
[  361.827251] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  361.827989] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  361.828712] Call Trace:
[  361.828964]  <TASK>
[  361.829182]  smc_llc_srv_rkey_exchange+0xa7/0x190 [smc]
[  361.829726]  smc_llc_srv_add_link+0x3ae/0x5a0 [smc]
[  361.830246]  smc_llc_add_link_work+0xb8/0x140 [smc]
[  361.830752]  process_one_work+0x1e5/0x3f0
[  361.831173]  worker_thread+0x4d/0x2f0
[  361.831531]  ? __pfx_worker_thread+0x10/0x10
[  361.831925]  kthread+0xe5/0x120
[  361.832239]  ? __pfx_kthread+0x10/0x10
[  361.832630]  ret_from_fork+0x2c/0x50
[  361.833004]  </TASK>
[  361.833236] Modules linked in: binfmt_misc(E) smc_diag(E) smc(E) rfkill(E) intel_rapl_msr(E) intel_rapl_common(E) 
mousedev(E) psmouse(E) i2c_piix4(E) pcspkr(E) ip_tables(E) mlx5_ib(E) ib_uverbs(E) ib_core(E) cirrus(E) ata_generic(E) 
drm_shmem_helper(E) drm_kms_helper(E) syscopyarea(E) ata_piix(E) sysfillrect(E) crct10dif_pclmul(E) sysimgblt(E) 
mlx5_core(E) crc32_pclmul(E) drm(E) virtio_net(E) mlxfw(E) crc32c_intel(E) ghash_clmulni_intel(E) net_failover(E) 
psample(E) i2c_core(E) failover(E) pci_hyperv_intf(E) serio_raw(E) libata(E) dm_mirror(E) dm_region_hash(E) dm_log(E) 
dm_mod(E)
[  361.839180] CR2: 0000000000000014

Thanks,
Wen Gu