netdev - Re: [PATCH] net: core: dev: Initialise napi state correctly

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Wed, 23 Jan 2019 11:00:01 -0800
From:   Eric Dumazet <eric.dumazet@...il.com>
To:     David McKay <mckay.david@...il.com>,
        Linux Networking <netdev@...r.kernel.org>
Subject: Re: [PATCH] net: core: dev: Initialise napi state correctly



On 01/23/2019 10:49 AM, David McKay wrote:
> On Fri, 18 Jan 2019 at 17:15, Eric Dumazet <eric.dumazet@...il.com> wrote:
>>
>>
>>
>> On 01/18/2019 04:46 AM, Dave McKay wrote:
>>> The state member of the napi_struct is not initialised correctly, it
>>> sets the SCHED bit without initialising the state to zero first. This
>>> results in peculiar behaviour if the original napi_struct didn't come
>>> from a zero initialised region to start with.
>>>
>>> This patch just sets it directly using the appropriate bitfield
>>> constant.
>>>
>>> Signed-off-by: Dave McKay <mckay.david@...il.com>
>>> ---
>>>  net/core/dev.c | 2 +-
>>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>>
>>> diff --git a/net/core/dev.c b/net/core/dev.c
>>> index 82f20022259d..250f97bf1973 100644
>>> --- a/net/core/dev.c
>>> +++ b/net/core/dev.c
>>> @@ -6276,7 +6276,7 @@ void netif_napi_add(struct net_device *dev, struct napi_struct *napi,
>>>  #ifdef CONFIG_NETPOLL
>>>       napi->poll_owner = -1;
>>>  #endif
>>> -     set_bit(NAPI_STATE_SCHED, &napi->state);
>>> +     napi->state = NAPIF_STATE_SCHED;
>>>       napi_hash_add(napi);
>>>  }
>>>  EXPORT_SYMBOL(netif_napi_add);
>>>
>>
>> I am curious, which driver has exhibit any issue with current code ?
>>
> 
> gro_cell_init() maybe?
> 

Perfect example of something that would break with your patch :/

alloc_percpu() clears all memory.


gro_cells_init() does :

set_bit(NAPI_STATE_NO_BUSY_POLL, &cell->napi.state);
netif_napi_add(dev, &cell->napi, gro_cell_poll, ...)

So clearing napi->state in netif_napi_add() would remove the NAPI_STATE_NO_BUSY_POLL setting.