netdev - Re: [PATCH net] net: thunderx: fix NULL pointer dereference in nicvf_open/nicvf

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAGnkfhy7zgi9mZTNBe1eekJDSe9EKjYrAsnDqUAfK16ANcL3Mw@mail.gmail.com>
Date:   Thu, 4 Apr 2019 14:42:15 +0200
From:   Matteo Croce <mcroce@...hat.com>
To:     Lorenzo Bianconi <lorenzo.bianconi@...hat.com>
Cc:     "David S . Miller" <davem@...emloft.net>,
        netdev <netdev@...r.kernel.org>, vlomovtsev@...vell.com
Subject: Re: [PATCH net] net: thunderx: fix NULL pointer dereference in nicvf_open/nicvf_stop

On Thu, Apr 4, 2019 at 12:16 PM Lorenzo Bianconi
<lorenzo.bianconi@...hat.com> wrote:
>
> When a bpf program is uploaded, the driver computes the number of
> xdp tx queues resulting in the allocation of additional qsets.
> Starting from commit '2ecbe4f4a027 ("net: thunderx: replace global
> nicvf_rx_mode_wq work queue for all VFs to private for each of them")'
> the driver runs link state polling for each VF resulting in the
> following NULL pointer dereference:
>
> Fixes: 2ecbe4f4a027 ("net: thunderx: replace global nicvf_rx_mode_wq work queue for all VFs to private for each of them")
> Fixes: 2c632ad8bc74 ("net: thunderx: move link state polling function to VF")
> Reported-by: Matteo Croce <mcroce@...hat.com>
> Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@...hat.com>
>

root@...nderx:~# uname -r
5.1.0-rc3+
root@...nderx:~# ip -d link show dev enP2p1s0v0
2: enP2p1s0v0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 xdp qdisc mq
state UP mode DEFAULT group default qlen 1000
    link/ether 1c:1b:0d:0d:52:a4 brd ff:ff:ff:ff:ff:ff promiscuity 0
addrgenmode none numtxqueues 48 numrxqueues 48 gso_max_size 65536
gso_max_segs 65535
    prog/xdp id 2 tag 444c1e2fd143efc0 jited

Tested-by: Matteo Croce <mcroce@...hat.com>

-- 
Matteo Croce
per aspera ad upstream