netdev - Re: NULL deref in bnx2 / crashes ? ( was: netconsole leads to stalled CPU task )

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1345640757.5158.1321.camel@edumazet-glaptop>
Date:	Wed, 22 Aug 2012 15:05:57 +0200
From:	Eric Dumazet <eric.dumazet@...il.com>
To:	Sylvain Munaut <s.munaut@...tever-company.com>
Cc:	netdev@...r.kernel.org
Subject: Re: NULL deref in bnx2 / crashes ? ( was: netconsole leads to
 stalled CPU task )

On Wed, 2012-08-22 at 14:17 +0200, Sylvain Munaut wrote:
> Hi,
> 
> > Could be the infamous slave_dev_queue_mapping striking again.
> >
> > Could you please try :
> >
> > diff --git a/net/core/netpoll.c b/net/core/netpoll.c
> > index 346b1eb..df731a0 100644
> > --- a/net/core/netpoll.c
> > +++ b/net/core/netpoll.c
> > @@ -335,8 +335,11 @@ void netpoll_send_skb_on_dev(struct netpoll *np, struct sk_buff *skb,
> >         /* don't get messages out of order, and no recursion */
> >         if (skb_queue_len(&npinfo->txq) == 0 && !netpoll_owner_active(dev)) {
> >                 struct netdev_queue *txq;
> > +               int queue_index = skb_get_queue_mapping(skb);
> >
> > -               txq = netdev_get_tx_queue(dev, skb_get_queue_mapping(skb));
> > +               if (queue_index >= dev->real_num_tx_queues)
> > +                       queue_index = 0;
> > +               txq = netdev_get_tx_queue(dev, queue_index);
> >
> >                 /* try until next clock tick */
> >                 for (tries = jiffies_to_usecs(1)/USEC_PER_POLL;
> 
> 
> Well, it doesn't solve the problem :(
> 
> It does have an effect though. Now even on the machine with the
> broadcom card, it just freeze the machine ...
> On the machine with intel card, it actually does get a couple of
> netconsole packet out and then freeze as well.
> 

my patch was incomplete, sorry :

diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index 346b1eb..ddc453b 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -335,8 +335,13 @@ void netpoll_send_skb_on_dev(struct netpoll *np, struct sk_buff *skb,
 	/* don't get messages out of order, and no recursion */
 	if (skb_queue_len(&npinfo->txq) == 0 && !netpoll_owner_active(dev)) {
 		struct netdev_queue *txq;
+		int queue_index = skb_get_queue_mapping(skb);
 
-		txq = netdev_get_tx_queue(dev, skb_get_queue_mapping(skb));
+		if (queue_index >= dev->real_num_tx_queues) {
+			queue_index = 0;
+			skb_set_queue_mapping(skb, 0);
+		}
+		txq = netdev_get_tx_queue(dev, queue_index);
 
 		/* try until next clock tick */
 		for (tries = jiffies_to_usecs(1)/USEC_PER_POLL;


--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html