netdev - Re: Realtek 8139 driver (8139too.c) TX Timeout doesn't allow interrupt handler to disable receive interrupts at high bi-directional traffic

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20061129233219.GD18057@electric-eye.fr.zoreil.com>
Date:	Thu, 30 Nov 2006 00:32:19 +0100
From:	Francois Romieu <romieu@...zoreil.com>
To:	Stephen Hemminger <shemminger@...l.org>
Cc:	"Basheer, Mansoor Ahamed" <mansoor.ahamed@...com>,
	netdev@...r.kernel.org
Subject: Re: Realtek 8139 driver (8139too.c) TX Timeout doesn't allow interrupt handler to disable receive interrupts at high bi-directional traffic

Stephen Hemminger <shemminger@...l.org> :
> Francois Romieu <romieu@...zoreil.com> wrote:
> > Stephen Hemminger <shemminger@...l.org> :
> > [...]
> > > @@ -1682,12 +1685,11 @@ static void rtl8139_tx_timeout_task (voi
> > >  	rtl8139_tx_clear (tp);
> > >  	spin_unlock_irq(&tp->lock);
> > >  
> > > +	netif_poll_enable();
> >                           ^ -> dev
> > > +
> > >  	/* ...and finally, reset everything */
> > > -	if (netif_running(dev)) {
> > > -		rtl8139_hw_start (dev);
> > > -		netif_wake_queue (dev);
> > > -	}
> > > -	spin_unlock_bh(&tp->rx_lock);
> > > +	rtl8139_hw_start (dev);
> > > +	netif_wake_queue (dev);
> > >  }
> > 
> > rtl8139_hw_start() may mess with cur_rx, whence a race with rtl8139_rx()
> > if an in-flight interruption enables it a bit too fast. I'd rather go
> > with:
> 
> but rt8139_rx is not possible here because we have blocked the poll
> routine from starting.  Basically it uses the NAPI rx scheduler bit
> to replace the rx_lock.

1 - the irq handler is waiting for tp->lock
2 - rtl8139_tx_timeout_task releases the lock
3 - rtl8139_tx_timeout_task issues netif_poll_enable
4 - the irq handler schedules ->poll(), returns
5 - rtl8139_hw_start() races with ->poll(), aka rtl8139_rx(), for cur_rx

-- 
Ueimor
-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html