netdev - Re: [PATCH net]tg3: tg3_disable_ints using uninitialized mailbox value to disable interrupts

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Mon, 22 Dec 2014 16:13:48 -0500 (EST)
From:	David Miller <davem@...emloft.net>
To:	prashant@...adcom.com
Cc:	netdev@...r.kernel.org, linux-pci@...r.kernel.org,
	nholland@...ys.org, marcelo.leitner@...il.com, bhelgaas@...gle.com,
	rajatxjain@...il.com, mchan@...adcom.com
Subject: Re: [PATCH net]tg3: tg3_disable_ints using uninitialized mailbox
 value to disable interrupts

From: Prashant Sreedharan <prashant@...adcom.com>
Date: Sat, 20 Dec 2014 12:16:17 -0800

> During driver load in tg3_init_one, if the driver detects DMA activity before
> intializing the chip tg3_halt is called. As part of tg3_halt interrupts are
> disabled using routine tg3_disable_ints. This routine was using mailbox value
> which was not initialized (default value is 0). As a result driver was writing
> 0x00000001 to pci config space register 0, which is the vendor id / device id.
> 
> This driver bug was exposed because of the commit a7877b17a667 (PCI: Check only
> the Vendor ID to identify Configuration Request Retry). Also this issue is only
> seen in older generation chipsets like 5722 because config space write to offset
> 0 from driver is possible. The newer generation chips ignore writes to offset 0.
> Also without commit a7877b17a667, for these older chips when a GRC reset is
> issued the Bootcode would reprogram the vendor id/device id, which is the reason
> this bug was masked earlier.
> 
> Fixed by initializing the interrupt mailbox registers before calling tg3_halt.
> 
> Please queue for -stable.
> 
> Reported-by: Nils Holland <nholland@...ys.org>
> Reported-by: Marcelo Ricardo Leitner <marcelo.leitner@...il.com>
> Signed-off-by: Prashant Sreedharan <prashant@...adcom.com>
> Signed-off-by: Michael Chan <mchan@...adcom.com>

Applied and queued up for -stable, thanks.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html