netdev - stmmac: Race in coalesce timer and NAPI

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <dd4b67f1-5ce7-22e2-8fe5-8925ec016386@synopsys.com>
Date:   Fri, 21 Sep 2018 10:19:45 +0100
From:   Jose Abreu <Jose.Abreu@...opsys.com>
To:     "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
        Joao Pinto <Joao.Pinto@...opsys.com>
Subject: stmmac: Race in coalesce timer and NAPI

Hello,

I'm getting a race in stmmac coalesce timer and the
napi_schedule() interrupt and I'm asking for advice. Currently,
we are scheduling NAPI in coalesce timer but this leads to
stmmac_tx_clean() deadlock because this function tries to acquire
queue lock.

I find that this is not expected because only one instance of
NAPI should run at same time so I was wondering if it is possible
that xmit() callback is causing the deadlock ?

BTW, this is solved by:
    - Directly call stmmac_tx_clean() in timer function AND
    - Use netif_tx_trylock() in stmmac_tx_clean(). Then, if queue
is already locked we re-arm coalesce timer or reschedule NAPI.

This is easily reproducible in an ARM board with 8 core running
at 100MHz each.

Thanks and Best Regards,
Jose Miguel Abreu