netdev - [PATCH net] igb: re-assign hw address pointer on reset after PCI error

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 31 Oct 2016 18:12:29 -0200
From:   "Guilherme G. Piccoli" <gpiccoli@...ux.vnet.ibm.com>
To:     intel-wired-lan@...ts.osuosl.org
Cc:     jeffrey.t.kirsher@...el.com, gpiccoli@...ux.vnet.ibm.com,
        netdev@...r.kernel.org
Subject: [PATCH net] igb: re-assign hw address pointer on reset after PCI error

Whenever the igb driver detects the result of a read operation returns
a value composed only by F's (like 0xFFFFFFFF), it will detach the
net_device, clear the hw_addr pointer and warn to the user that adapter's
link is lost - those steps happen on igb_rd32().

In case a PCI error happens on Power architecture, there's a recovery
mechanism called EEH, that will reset the PCI slot and call driver's
handlers to reset the adapter and network functionality as well.

We observed that once hw_addr is NULL after the error is detected on
igb_rd32(), it's never assigned back, so in the process of resetting
the network functionality we got a NULL pointer dereference in both
igb_configure_tx_ring() and igb_configure_rx_ring(). In order to avoid
such bug, we re-assign the hw_addr value in the beginning of the
function igb_reset(), in case the hw_addr is NULL when we reach that
path.

Reported-by: Anthony H. Thai <ahthai@...ibm.com>
Reported-by: Harsha Thyagaraja <hathyaga@...ibm.com>
Signed-off-by: Guilherme G. Piccoli <gpiccoli@...ux.vnet.ibm.com>
---
 drivers/net/ethernet/intel/igb/igb_main.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index edc9a6a..c19119c 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -1873,6 +1873,13 @@ void igb_reset(struct igb_adapter *adapter)
 	struct e1000_fc_info *fc = &hw->fc;
 	u32 pba, hwm;

+	/* In case of PCI error, adapter might have lost its HW
+	 * address; if we reached this point after an error scenario,
+	 * we should re-assign the hw_addr based on the saved io_addr.
+	 */
+	if (!hw->hw_addr)
+		hw->hw_addr = adapter->io_addr;
+
 	/* Repartition Pba for greater than 9k mtu
 	 * To take effect CTRL.RST is required.
 	 */
-- 
2.1.0