lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <1556103931-64031-2-git-send-email-tanhuazhong@huawei.com> Date: Wed, 24 Apr 2019 19:05:20 +0800 From: Huazhong Tan <tanhuazhong@...wei.com> To: <davem@...emloft.net> CC: <netdev@...r.kernel.org>, <linux-kernel@...r.kernel.org>, <salil.mehta@...wei.com>, <yisen.zhuang@...wei.com>, <linuxarm@...wei.com>, <nhorman@...hat.com>, Yunsheng Lin <linyunsheng@...wei.com>, Peng Li <lipeng321@...wei.com>, Huazhong Tan <tanhuazhong@...wei.com> Subject: [PATCH V2 net-next 01/12] net: hns3: fix data race between ring->next_to_clean From: Yunsheng Lin <linyunsheng@...wei.com> hns3_clean_tx_ring calls hns3_nic_reclaim_one_desc to clean buffers and set ring->next_to_clean, then hns3_nic_net_xmit reuses the cleaned buffers. But there are no memory barriers when buffers gets recycled, so the recycled buffers can be corrupted. This patch uses smp_store_release to update ring->next_to_clean and smp_load_acquire to read ring->next_to_clean to properly hand off buffers from hns3_clean_tx_ring to hns3_nic_net_xmit. Fixes: 76ad4f0ee747 ("net: hns3: Add support of HNS3 Ethernet Driver for hip08 SoC") Signed-off-by: Yunsheng Lin <linyunsheng@...wei.com> Signed-off-by: Peng Li <lipeng321@...wei.com> Signed-off-by: Huazhong Tan <tanhuazhong@...wei.com> --- drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 14 +++++++++++--- drivers/net/ethernet/hisilicon/hns3/hns3_enet.h | 7 +++++-- 2 files changed, 16 insertions(+), 5 deletions(-) diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c index 176d4b9..9fdc87e 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c @@ -2214,14 +2214,22 @@ static void hns3_reuse_buffer(struct hns3_enet_ring *ring, int i) static void hns3_nic_reclaim_one_desc(struct hns3_enet_ring *ring, int *bytes, int *pkts) { - struct hns3_desc_cb *desc_cb = &ring->desc_cb[ring->next_to_clean]; + int ntc = ring->next_to_clean; + struct hns3_desc_cb *desc_cb; + desc_cb = &ring->desc_cb[ntc]; (*pkts) += (desc_cb->type == DESC_TYPE_SKB); (*bytes) += desc_cb->length; /* desc_cb will be cleaned, after hnae3_free_buffer_detach*/ - hns3_free_buffer_detach(ring, ring->next_to_clean); + hns3_free_buffer_detach(ring, ntc); - ring_ptr_move_fw(ring, next_to_clean); + if (++ntc == ring->desc_num) + ntc = 0; + + /* This smp_store_release() pairs with smp_load_acquire() in + * ring_space called by hns3_nic_net_xmit. + */ + smp_store_release(&ring->next_to_clean, ntc); } static int is_valid_clean_head(struct hns3_enet_ring *ring, int h) diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h index cec56a5..2b4f5ea 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h +++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.h @@ -581,8 +581,11 @@ union l4_hdr_info { static inline int ring_space(struct hns3_enet_ring *ring) { - int begin = ring->next_to_clean; - int end = ring->next_to_use; + /* This smp_load_acquire() pairs with smp_store_release() in + * hns3_nic_reclaim_one_desc called by hns3_clean_tx_ring. + */ + int begin = smp_load_acquire(&ring->next_to_clean); + int end = READ_ONCE(ring->next_to_use); return ((end >= begin) ? (ring->desc_num - end + begin) : (begin - end)) - 1; -- 2.7.4
Powered by blists - more mailing lists