netdev - Re: [Intel-wired-lan] [PATCH net] igb: re-assign hw address pointer on reset after PCI error

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <5824A4DE.9020508@linux.vnet.ibm.com>
Date:   Thu, 10 Nov 2016 14:48:30 -0200
From:   "Guilherme G. Piccoli" <gpiccoli@...ux.vnet.ibm.com>
To:     Alexander Duyck <alexander.duyck@...il.com>
Cc:     intel-wired-lan <intel-wired-lan@...ts.osuosl.org>,
        Netdev <netdev@...r.kernel.org>,
        "Fujinaka, Todd" <todd.fujinaka@...el.com>
Subject: Re: [Intel-wired-lan] [PATCH net] igb: re-assign hw address pointer
 on reset after PCI error

On 11/09/2016 03:12 PM, Alexander Duyck wrote:
> On Mon, Oct 31, 2016 at 1:12 PM, Guilherme G. Piccoli
> <gpiccoli@...ux.vnet.ibm.com> wrote:
>> Whenever the igb driver detects the result of a read operation returns
>> a value composed only by F's (like 0xFFFFFFFF), it will detach the
>> net_device, clear the hw_addr pointer and warn to the user that adapter's
>> link is lost - those steps happen on igb_rd32().
>>
>> In case a PCI error happens on Power architecture, there's a recovery
>> mechanism called EEH, that will reset the PCI slot and call driver's
>> handlers to reset the adapter and network functionality as well.
>>
>> We observed that once hw_addr is NULL after the error is detected on
>> igb_rd32(), it's never assigned back, so in the process of resetting
>> the network functionality we got a NULL pointer dereference in both
>> igb_configure_tx_ring() and igb_configure_rx_ring(). In order to avoid
>> such bug, we re-assign the hw_addr value in the beginning of the
>> function igb_reset(), in case the hw_addr is NULL when we reach that
>> path.
>>
>> Reported-by: Anthony H. Thai <ahthai@...ibm.com>
>> Reported-by: Harsha Thyagaraja <hathyaga@...ibm.com>
>> Signed-off-by: Guilherme G. Piccoli <gpiccoli@...ux.vnet.ibm.com>
>> ---
>>  drivers/net/ethernet/intel/igb/igb_main.c | 7 +++++++
>>  1 file changed, 7 insertions(+)
>>
>> diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
>> index edc9a6a..c19119c 100644
>> --- a/drivers/net/ethernet/intel/igb/igb_main.c
>> +++ b/drivers/net/ethernet/intel/igb/igb_main.c
>> @@ -1873,6 +1873,13 @@ void igb_reset(struct igb_adapter *adapter)
>>         struct e1000_fc_info *fc = &hw->fc;
>>         u32 pba, hwm;
>>
>> +       /* In case of PCI error, adapter might have lost its HW
>> +        * address; if we reached this point after an error scenario,
>> +        * we should re-assign the hw_addr based on the saved io_addr.
>> +        */
>> +       if (!hw->hw_addr)
>> +               hw->hw_addr = adapter->io_addr;
>> +
>>         /* Repartition Pba for greater than 9k mtu
>>          * To take effect CTRL.RST is required.
>>          */
> 
> It seems like this would have the potential to get noisy pretty
> quickly since every reset would retrigger this.
> 
> It might make more sense to move this line into igb_io_slot_reset and
> igb_resume where the device would have gone through a reset of some
> sort and then had the state of the device restored and the device
> memory access was re-enabled via pci_enable_device_mem.  Also there is
> no point in really doing the "if" since you should always be okay to
> overwrite hw->hw_addr with adapter->io_addr.

Thanks for the good suggestion Alexander, will send a V2.
Cheers,

Guilherme


> 
> Thanks.
> 
> - Alex
>