linux-kernel - [PATCH v2 2/2] net/ncsi: fix state race during channel probe completion

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20250111-fix-ncsi-mac-v2-2-838e0a1a233a@gmail.com>
Date: Sat, 11 Jan 2025 18:59:44 +0800
From: Potin Lai <potin.lai.pt@...il.com>
To: Samuel Mendoza-Jonas <sam@...dozajonas.com>, 
 "David S. Miller" <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>, 
 Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>, 
 Simon Horman <horms@...nel.org>, Ivan Mikhaylov <fr0st61te@...il.com>, 
 Paul Fertser <fercerpav@...il.com>, Patrick Williams <patrick@...cx.xyz>
Cc: netdev@...r.kernel.org, linux-kernel@...r.kernel.org, 
 Cosmo Chou <cosmo.chou@...ntatw.com>, Potin Lai <potin.lai@...ntatw.com>, 
 Potin Lai <potin.lai.pt@...il.com>, Cosmo Chou <chou.cosmo@...il.com>
Subject: [PATCH v2 2/2] net/ncsi: fix state race during channel probe
 completion

From: Cosmo Chou <chou.cosmo@...il.com>

During channel probing, the last NCSI_PKT_CMD_DP command can trigger
an unnecessary schedule_work() via ncsi_free_request(). We observed
that subsequent config states were triggered before the scheduled
work completed, causing potential state handling issues.

Fix this by clearing req_flags when processing the last package.

Fixes: 8e13f70be05e ("net/ncsi: Probe single packages to avoid conflict")
Signed-off-by: Cosmo Chou <chou.cosmo@...il.com>
---
 net/ncsi/ncsi-manage.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/net/ncsi/ncsi-manage.c b/net/ncsi/ncsi-manage.c
index bf276eaf9330..632281816f11 100644
--- a/net/ncsi/ncsi-manage.c
+++ b/net/ncsi/ncsi-manage.c
@@ -1491,7 +1491,10 @@ static void ncsi_probe_channel(struct ncsi_dev_priv *ndp)
 		}
 		break;
 	case ncsi_dev_state_probe_dp:
-		ndp->pending_req_num = 1;
+		if (ndp->package_probe_id + 1 < ndp->max_package)
+			ndp->pending_req_num = 1;
+		else
+			nca.req_flags = 0;

 		/* Deselect the current package */
 		nca.type = NCSI_PKT_CMD_DP;

-- 
2.31.1