linux-kernel - Re: [PATCH iwl-net] i40e: Fix kernel crash during macvlan offloading setup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20231129163618.GD43811@kernel.org>
Date:   Wed, 29 Nov 2023 16:36:18 +0000
From:   Simon Horman <horms@...nel.org>
To:     Ivan Vecera <ivecera@...hat.com>
Cc:     netdev@...r.kernel.org, Jacob Keller <jacob.e.keller@...el.com>,
        Wojciech Drewek <wojciech.drewek@...el.com>,
        Jesse Brandeburg <jesse.brandeburg@...el.com>,
        Tony Nguyen <anthony.l.nguyen@...el.com>,
        "David S. Miller" <davem@...emloft.net>,
        Eric Dumazet <edumazet@...gle.com>,
        Jakub Kicinski <kuba@...nel.org>,
        Paolo Abeni <pabeni@...hat.com>,
        Harshitha Ramamurthy <harshitha.ramamurthy@...el.com>,
        Jeff Kirsher <jeffrey.t.kirsher@...el.com>,
        "moderated list:INTEL ETHERNET DRIVERS" 
        <intel-wired-lan@...ts.osuosl.org>,
        open list <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH iwl-net] i40e: Fix kernel crash during macvlan offloading
 setup

On Fri, Nov 24, 2023 at 05:42:33PM +0100, Ivan Vecera wrote:
> Function i40e_fwd_add() computes num of created channels and
> num of queues per channel according value of pf->num_lan_msix.
> 
> This is wrong because the channels are used for subordinated net
> devices that reuse existing queues from parent net device and
> number of existing queue pairs (pf->num_queue_pairs) should be
> used instead.
> 
> E.g.:
> Let's have (pf->num_lan_msix == 32)... Then we reduce number of
> combined queues by ethtool to 8 (so pf->num_queue_pairs == 8).
> i40e_fwd_add() called by macvlan then computes number of macvlans
> channels to be 16 and queues per channel 1 and calls
> i40e_setup_macvlans(). This computes new number of queue pairs
> for PF as:
> 
> num_qps = vsi->num_queue_pairs - (macvlan_cnt * qcnt);
> 
> This is evaluated in this case as:
> num_qps = (8 - 16 * 1) = (u16)-8 = 0xFFF8
> 
> ...and this number is stored vsi->next_base_queue that is used
> during channel creation. This leads to kernel crash.
> 
> Fix this bug by computing the number of offloaded macvlan devices
> and no. their queues according the current number of queues instead
> of maximal one.
> 
> Reproducer:
> 1) Enable l2-fwd-offload
> 2) Reduce number of queues
> 3) Create macvlan device
> 4) Make it up
> 
> Result:
> [root@...-03 ~]# ethtool -K enp2s0f0np0 l2-fwd-offload on
> [root@...-03 ~]# ethtool -l enp2s0f0np0 | grep Combined
> Combined:       32
> Combined:       32
> [root@...-03 ~]# ethtool -L enp2s0f0np0 combined 8
> [root@...-03 ~]# ip link add link enp2s0f0np0 mac0 type macvlan mode bridge
> [root@...-03 ~]# ip link set mac0 up
> ...
> [ 1225.686698] i40e 0000:02:00.0: User requested queue count/HW max RSS count:  8/32
> [ 1242.399103] BUG: kernel NULL pointer dereference, address: 0000000000000118
> [ 1242.406064] #PF: supervisor write access in kernel mode
> [ 1242.411288] #PF: error_code(0x0002) - not-present page
> [ 1242.416417] PGD 0 P4D 0
> [ 1242.418950] Oops: 0002 [#1] PREEMPT SMP NOPTI
> [ 1242.423308] CPU: 26 PID: 2253 Comm: ip Kdump: loaded Not tainted 6.7.0-rc1+ #20
> [ 1242.430607] Hardware name: Abacus electric, s.r.o. - servis@...cus.cz Super Server/H12SSW-iN, BIOS 2.4 04/13/2022
> [ 1242.440850] RIP: 0010:i40e_channel_config_tx_ring.constprop.0+0xd9/0x180 [i40e]
> [ 1242.448165] Code: 48 89 b3 80 00 00 00 48 89 bb 88 00 00 00 74 3c 31 c9 0f b7 53 16 49 8b b4 24 f0 0c 00 00 01 ca 83 c1 01 0f b7 d2 48 8b 34 d6 <48> 89 9e 18 01 00 00 49 8b b4 24 e8 0c 00 00 48 8b 14 d6 48 89 9a
> [ 1242.466902] RSP: 0018:ffffa4d52cd2f610 EFLAGS: 00010202
> [ 1242.472121] RAX: 0000000000000000 RBX: ffff9390a4ba2e40 RCX: 0000000000000001
> [ 1242.479244] RDX: 000000000000fff8 RSI: 0000000000000000 RDI: ffffffffffffffff
> [ 1242.486370] RBP: ffffa4d52cd2f650 R08: 0000000000000020 R09: 0000000000000000
> [ 1242.493494] R10: 0000000000000000 R11: 0000000100000001 R12: ffff9390b861a000
> [ 1242.500626] R13: 00000000000000a0 R14: 0000000000000010 R15: ffff9390b861a000
> [ 1242.507751] FS:  00007efda536b740(0000) GS:ffff939f4ec80000(0000) knlGS:0000000000000000
> [ 1242.515826] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 1242.521564] CR2: 0000000000000118 CR3: 000000010bd48002 CR4: 0000000000770ef0
> [ 1242.528699] PKRU: 55555554
> [ 1242.531400] Call Trace:
> [ 1242.533846]  <TASK>
> [ 1242.535943]  ? __die+0x20/0x70
> [ 1242.539004]  ? page_fault_oops+0x76/0x170
> [ 1242.543018]  ? exc_page_fault+0x65/0x150
> [ 1242.546942]  ? asm_exc_page_fault+0x22/0x30
> [ 1242.551131]  ? i40e_channel_config_tx_ring.constprop.0+0xd9/0x180 [i40e]
> [ 1242.557847]  i40e_setup_channel.part.0+0x5f/0x130 [i40e]
> [ 1242.563167]  i40e_setup_macvlans.constprop.0+0x256/0x420 [i40e]
> [ 1242.569099]  i40e_fwd_add+0xbf/0x270 [i40e]
> [ 1242.573300]  macvlan_open+0x16f/0x200 [macvlan]
> [ 1242.577831]  __dev_open+0xe7/0x1b0
> [ 1242.581236]  __dev_change_flags+0x1db/0x250
> ...
> 
> Fixes: 1d8d80b4e4ff ("i40e: Add macvlan support on i40e")
> Signed-off-by: Ivan Vecera <ivecera@...hat.com>

Thanks Ivan,

I agree with the analysis and that the problem was introduced by the cited
patch.

Reviewed-by: Simon Horman <horms@...nel.org>