linux-kernel - Re: [PATCH net 2/3] net/mlx5e: Fix race between DIM disable and net

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <a3262f60-31c0-4606-be0d-2dd14505329d@intel.com>
Date: Thu, 10 Jul 2025 09:31:16 -0700
From: Jacob Keller <jacob.e.keller@...el.com>
To: Tariq Toukan <tariqt@...dia.com>, Eric Dumazet <edumazet@...gle.com>,
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>, "Andrew
 Lunn" <andrew+netdev@...n.ch>, "David S. Miller" <davem@...emloft.net>
CC: Saeed Mahameed <saeed@...nel.org>, Gal Pressman <gal@...dia.com>, "Leon
 Romanovsky" <leon@...nel.org>, Saeed Mahameed <saeedm@...dia.com>, Mark Bloch
	<mbloch@...dia.com>, <netdev@...r.kernel.org>, <linux-rdma@...r.kernel.org>,
	<linux-kernel@...r.kernel.org>, Carolina Jubran <cjubran@...dia.com>
Subject: Re: [PATCH net 2/3] net/mlx5e: Fix race between DIM disable and
 net_dim()



On 7/10/2025 6:53 AM, Tariq Toukan wrote:
> From: Carolina Jubran <cjubran@...dia.com>
> 
> There's a race between disabling DIM and NAPI callbacks using the dim
> pointer on the RQ or SQ.
> 
> If NAPI checks the DIM state bit and sees it still set, it assumes
> `rq->dim` or `sq->dim` is valid. But if DIM gets disabled right after
> that check, the pointer might already be set to NULL, leading to a NULL
> pointer dereference in net_dim().
> 
> Fix this by calling `synchronize_net()` before freeing the DIM context.
> This ensures all in-progress NAPI callbacks are finished before the
> pointer is cleared.
> 
> Kernel log:
> 
> BUG: kernel NULL pointer dereference, address: 0000000000000000
> ...
> RIP: 0010:net_dim+0x23/0x190
> ...
> Call Trace:
>  <TASK>
>  ? __die+0x20/0x60
>  ? page_fault_oops+0x150/0x3e0
>  ? common_interrupt+0xf/0xa0
>  ? sysvec_call_function_single+0xb/0x90
>  ? exc_page_fault+0x74/0x130
>  ? asm_exc_page_fault+0x22/0x30
>  ? net_dim+0x23/0x190
>  ? mlx5e_poll_ico_cq+0x41/0x6f0 [mlx5_core]
>  ? sysvec_apic_timer_interrupt+0xb/0x90
>  mlx5e_handle_rx_dim+0x92/0xd0 [mlx5_core]
>  mlx5e_napi_poll+0x2cd/0xac0 [mlx5_core]
>  ? mlx5e_poll_ico_cq+0xe5/0x6f0 [mlx5_core]
>  busy_poll_stop+0xa2/0x200
>  ? mlx5e_napi_poll+0x1d9/0xac0 [mlx5_core]
>  ? mlx5e_trigger_irq+0x130/0x130 [mlx5_core]
>  __napi_busy_loop+0x345/0x3b0
>  ? sysvec_call_function_single+0xb/0x90
>  ? asm_sysvec_call_function_single+0x16/0x20
>  ? sysvec_apic_timer_interrupt+0xb/0x90
>  ? pcpu_free_area+0x1e4/0x2e0
>  napi_busy_loop+0x11/0x20
>  xsk_recvmsg+0x10c/0x130
>  sock_recvmsg+0x44/0x70
>  __sys_recvfrom+0xbc/0x130
>  ? __schedule+0x398/0x890
>  __x64_sys_recvfrom+0x20/0x30
>  do_syscall_64+0x4c/0x100
>  entry_SYSCALL_64_after_hwframe+0x4b/0x53
> ...
> ---[ end trace 0000000000000000 ]---
> ...
> ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---
> 

Reviewed-by: Jacob Keller <jacob.e.keller@...el.com>

> Fixes: 445a25f6e1a2 ("net/mlx5e: Support updating coalescing configuration without resetting channels")
> Signed-off-by: Carolina Jubran <cjubran@...dia.com>
> Reviewed-by: Cosmin Ratiu <cratiu@...dia.com>
> Signed-off-by: Tariq Toukan <tariqt@...dia.com>
> ---
>  drivers/net/ethernet/mellanox/mlx5/core/en_dim.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_dim.c b/drivers/net/ethernet/mellanox/mlx5/core/en_dim.c
> index 298bb74ec5e9..d1d629697e28 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/en_dim.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_dim.c
> @@ -113,7 +113,7 @@ int mlx5e_dim_rx_change(struct mlx5e_rq *rq, bool enable)
>  		__set_bit(MLX5E_RQ_STATE_DIM, &rq->state);
>  	} else {
>  		__clear_bit(MLX5E_RQ_STATE_DIM, &rq->state);
> -
> +		synchronize_net();

We've requested NAPI be disabled by this point, and just need to
guarantee that the already running threads close. Makes sense.

>  		mlx5e_dim_disable(rq->dim);
>  		rq->dim = NULL;
>  	}
> @@ -140,7 +140,7 @@ int mlx5e_dim_tx_change(struct mlx5e_txqsq *sq, bool enable)
>  		__set_bit(MLX5E_SQ_STATE_DIM, &sq->state);
>  	} else {
>  		__clear_bit(MLX5E_SQ_STATE_DIM, &sq->state);
> -
> +		synchronize_net();
>  		mlx5e_dim_disable(sq->dim);
>  		sq->dim = NULL;
>  	}




Download attachment "OpenPGP_signature.asc" of type "application/pgp-signature" (237 bytes)