netdev - Re: [PATCH] Re: kernel BUG in eth_alloc_tx_desc_index at drivers/net/mv643xx

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sun, 21 Jan 2007 14:02:15 +0100
From:	"Thibaut VARENE" <T-Bone@...isc-linux.org>
To:	"Jarek Poplawski" <jarkao2@...pl>
Cc:	"Dale Farnsworth" <dale@...nsworth.org>, netdev@...r.kernel.org,
	mlachwani@...sta.com
Subject: Re: [PATCH] Re: kernel BUG in eth_alloc_tx_desc_index at drivers/net/mv643xx_eth.c:1069!

On 1/21/07, Thibaut VARENE <T-Bone@...isc-linux.org> wrote:
> On 1/11/07, Jarek Poplawski <jarkao2@...pl> wrote:
> >
> > PS: alas I didn't even check compiling - I had no time to
> > find all compile dependencies of this driver
> > ---
> Hmm, I think this is guaranteed not to work. In between those lines
> the lock is released, while data in the mp structure is still being
> accessed. It seems that this bit of code is indeed not race-safe
> though, I'm gonna try to figure something.

This was indeed the right spot. The attached raw hack seems to fix the
bug (I couldn't crash the box so far).  I haven't checked that the
same "situation" happens elsewhere in the code, I leave that as an
exercise for the maintainers (or until I experience another kind of
crash :)

The patch is a bit ugly (printk with irq disabled will not show, etc)
but at least it does work. I'm sure somebody will figure something

HTH

T-Bone

-- 
Thibaut VARENE
http://www.parisc-linux.org/~varenet/

View attachment "fix_mv643xx_race.patch" of type "text/x-patch" (768 bytes)