netdev - liquidio vs smp_call_function_single

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20200608130430.GB2531@hirez.programming.kicks-ass.net>
Date:   Mon, 8 Jun 2020 15:04:30 +0200
From:   Peter Zijlstra <peterz@...radead.org>
To:     dchickles@...vell.com, sburla@...vell.com, fmanlunas@...vell.com
Cc:     frederic@...nel.org, linux-kernel@...r.kernel.org,
        davem@...emloft.net, kuba@...nel.org, netdev@...r.kernel.org
Subject: liquidio vs smp_call_function_single_async()

Hi,

I'm going through the smp_call_function_single_async() users, and
stumbled over your liquidio thingy. It does:

		call_single_data_t *csd = &droq->csd;

		csd->func = napi_schedule_wrapper;
		csd->info = &droq->napi;
		csd->flags = 0;

		smp_call_function_single_async(droq->cpu_id, csd);

which is almost certainly a bug. What guarantees that csd is unused when
you do this? What happens, if the remote CPU is already running RX and
consumes the packets before the IPI lands, and then this CPU gets
another interrupt.

AFAICT you then call this thing again, causing list corruption.