linux-kernel - [PATCH] nfp: nfp_alloc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <9EE5B02BB2EF6895+20250623041104.61044-1-wangyuli@uniontech.com>
Date: Mon, 23 Jun 2025 12:11:04 +0800
From: WangYuli <wangyuli@...ontech.com>
To: louis.peens@...igine.com,
	kuba@...nel.org,
	andrew+netdev@...n.ch,
	davem@...emloft.net,
	edumazet@...gle.com,
	pabeni@...hat.com,
	chenlinxuan@...ontech.com,
	wangyuli@...ontech.com,
	viro@...iv.linux.org.uk
Cc: oss-drivers@...igine.com,
	netdev@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	guanwentao@...ontech.com,
	niecheng1@...ontech.com,
	Jun Zhan <zhanjun@...ontech.com>
Subject: [PATCH] nfp: nfp_alloc_bar: Fix double unlock

The lock management in the nfp_alloc_bar function is problematic:

 *1. The function acquires the lock at the beginning:
spin_lock_irqsave(&nfp->bar_lock, irqflags).

  2. When barnum < 0 and in non-blocking mode, the code jumps to
the err_nobar label. However, in this non-blocking path, if
barnum < 0, the code releases the lock and calls nfp_wait_for_bar.

  3. Inside nfp_wait_for_bar, find_unused_bar_and_lock is called,
which holds the lock upon success (indicated by the __release
annotation). Consequently, when nfp_wait_for_bar returns
successfully, the lock is still held.

  4. But at the err_nobar label, the code always executes
spin_unlock_irqrestore(&nfp->bar_lock, irqflags).

  5. The problem arises when nfp_wait_for_bar successfully finds a
BAR: the lock is still held, but if a subsequent reconfigure_bar
fails, the code will attempt to unlock it again at err_nobar,
leading to a double unlock.

Reported-by: Jun Zhan <zhanjun@...ontech.com>
Co-developed-by: Chen Linxuan <chenlinxuan@...ontech.com>
Signed-off-by: Chen Linxuan <chenlinxuan@...ontech.com>
Signed-off-by: WangYuli <wangyuli@...ontech.com>
---
 drivers/net/ethernet/netronome/nfp/nfpcore/nfp6000_pcie.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ethernet/netronome/nfp/nfpcore/nfp6000_pcie.c b/drivers/net/ethernet/netronome/nfp/nfpcore/nfp6000_pcie.c
index 7c2200b49ce4..a7057de87301 100644
--- a/drivers/net/ethernet/netronome/nfp/nfpcore/nfp6000_pcie.c
+++ b/drivers/net/ethernet/netronome/nfp/nfpcore/nfp6000_pcie.c
@@ -489,6 +489,7 @@ nfp_alloc_bar(struct nfp6000_pcie *nfp,
 		if (retval)
 			return retval;
 		__acquire(&nfp->bar_lock);
+		spin_lock_irqsave(&nfp->bar_lock, irqflags);
 	}

 	nfp_bar_get(nfp, &nfp->bar[barnum]);
-- 
2.50.0