netdev - Re: [PATCH net-next] sfc: clear napi_hash state when copying channels

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20161113.134155.389939007693100035.davem@davemloft.net>
Date:   Sun, 13 Nov 2016 13:41:55 -0500 (EST)
From:   David Miller <davem@...emloft.net>
To:     bkenward@...arflare.com
Cc:     netdev@...r.kernel.org, linux-net-drivers@...arflare.com
Subject: Re: [PATCH net-next] sfc: clear napi_hash state when copying
 channels

From: Bert Kenward <bkenward@...arflare.com>
Date: Fri, 11 Nov 2016 15:56:51 +0000

> efx_copy_channel() doesn't correctly clear the napi_hash related state.
> This means that when napi_hash_add is called for that channel nothing is
> done, and we are left with a copy of the napi_hash_node from the old
> channel. When we later call napi_hash_del() on this channel we have a
> stale napi_hash_node.
> 
> Corruption is only seen when there are multiple entries in one of the
> napi_hash lists. This is made more likely by having a very large number
> of channels. Testing was carried out with 512 channels - 32 channels on
> each of 16 ports.
> 
> This failure typically appears as protection faults within napi_by_id()
> or napi_hash_add(). efx_copy_channel() is only used when tx or rx ring
> sizes are changed (ethtool -G).
> 
> Fixes: 36763266bbe8 ("sfc: Add support for busy polling")
> Signed-off-by: Bert Kenward <bkenward@...arflare.com>

Applied to net.