netdev - Re: [PATCH V2 2/2] bnx2x: Fix kernel crash and data miscompare after EEH recovery

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 29 May 2014 10:50:07 -0400
From:	wenxiong@...ux.vnet.ibm.com
To:	Dmitry Kravkov <Dmitry.Kravkov@...gic.com>
Cc:	David Miller <davem@...emloft.net>,
	Ariel Elior <Ariel.Elior@...gic.com>,
	netdev <netdev@...r.kernel.org>, Milton Miller <miltonm@....com>
Subject: Re: [PATCH V2 2/2] bnx2x: Fix kernel crash and data miscompare
 after EEH recovery


Quoting Dmitry Kravkov <Dmitry.Kravkov@...gic.com>:

>> -----Original Message-----
>> From: netdev-owner@...r.kernel.org [mailto:netdev-
>> owner@...r.kernel.org] On Behalf Of wenxiong@...ux.vnet.ibm.com
>> Sent: Wednesday, May 28, 2014 6:57 PM
>> To: David Miller
>> Cc: Ariel Elior; netdev; Milton Miller; Wen Xiong
>> Subject: [PATCH V2 2/2] bnx2x: Fix kernel crash and data miscompare after
>> EEH recovery
>>
>> A rmb() is required to ensure that the CQE is not read before it is  
>> written by
>> the adapter DMA.  PCI ordering rules will make sure the other fields are
>> written before the marker at the end of struct eth_fast_path_rx_cqe but
>> without rmb() a weakly ordered processor can process stale data.
>>
>> Without the barrier we have observed various crashes including
>> bnx2x_tpa_start being called on queues not stopped (resulting in message
>> start of bin not in stop) and NULL pointer exceptions from bnx2x_rx_int.
>>
>> Signed-off-by: Milton Miller <miltonm@....com>
>> Signed-off-by: Wen Xiong <wenxiong@...ux.vnet.ibm.com>
>> ---
>>  drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c |   12 ++++++++++++
>>  1 file changed, 12 insertions(+)
>>
>> Index: b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
>> ===================================================================
>> --- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c 2014-05-23
>> 10:34:21.000000000 -0500
>> +++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c 2014-05-28
>> 10:54:26.627766086 -0500
>> @@ -906,6 +906,18 @@ static int bnx2x_rx_int(struct bnx2x_fas
>>               bd_prod = RX_BD(bd_prod);
>>               bd_cons = RX_BD(bd_cons);
>>
>> +             /* A rmb() is required to ensure that the CQE is not read
>> +              * before it is written by the adapter DMA.  PCI ordering
>> +              * rules will make sure the other fields are written before
>> +              * the marker at the end of struct eth_fast_path_rx_cqe
>> +              * but without rmb() a weakly ordered processor can process
>> +              * stale data.  Without the barrier TPA state-machine might
>> +              * enter inconsistent state and kernel stack might be
>> +              * provided with incorrect packet description - these lead
>> +              * to various kernel crashed.
>> +             */
>> +             rmb();
>> +
>>               cqe_fp_flags = cqe_fp->type_error_flags;
>>               cqe_fp_type = cqe_fp_flags &
>> ETH_FAST_PATH_RX_CQE_TYPE;
>>
> The subject states 'EEH recovery', but looks like this is not the  
> only case. Other than that:
>
> Acked-by: Dmitry Kravkov <dmitry.kravkov@...gic.com>
>
>
Hi Dmitry,

Can you check if you have any comments for 1/2 patch in this series?  
If you don't, can you ack the 1/2 patch as well?

Thanks,
Wendy
> ________________________________
>
> This message and any attached documents contain information from  
> QLogic Corporation or its wholly-owned subsidiaries that may be  
> confidential. If you are not the intended recipient, you may not  
> read, copy, distribute, or use this information. If you have  
> received this transmission in error, please notify the sender  
> immediately by reply e-mail and then delete this message.



--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html