netdev - RE: [PATCH/RFC] net: ethernet: ravb: Try to wake subqueue instead of stop on timeout

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 29 Jun 2020 05:24:56 +0000
From:   Yoshihiro Shimoda <yoshihiro.shimoda.uh@...esas.com>
To:     Sergei Shtylyov <sergei.shtylyov@...il.com>,
        "sergei.shtylyov@...entembedded.com" 
        <sergei.shtylyov@...entembedded.com>
CC:     "REE dirk.behme@...bosch.com" <dirk.behme@...bosch.com>,
        "Shashikant.Suguni@...bosch.com" <Shashikant.Suguni@...bosch.com>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
        "linux-renesas-soc@...r.kernel.org" 
        <linux-renesas-soc@...r.kernel.org>,
        "davem@...emloft.net" <davem@...emloft.net>,
        "kuba@...nel.org" <kuba@...nel.org>
Subject: RE: [PATCH/RFC] net: ethernet: ravb: Try to wake subqueue instead of
 stop on timeout

Hello!

> From: Yoshihiro Shimoda, Sent: Friday, June 19, 2020 2:46 PM
> 
> Hello!
> 
> > From: Sergei Shtylyov, Sent: Monday, June 15, 2020 5:13 PM
> >
> > Hello!
> >
> > On 15.06.2020 8:58, Yoshihiro Shimoda wrote:
> >
> > >> From: Yoshihiro Shimoda, Sent: Tuesday, May 26, 2020 6:47 PM
> > >>
> > >> According to the report of [1], this driver is possible to cause
> > >> the following error in ravb_tx_timeout_work().
> > >>
> > >> ravb e6800000.ethernet ethernet: failed to switch device to config mode
> > >>
> > >> This error means that the hardware could not change the state
> > >> from "Operation" to "Configuration" while some tx queue is operating.
> > >> After that, ravb_config() in ravb_dmac_init() will fail, and then
> > >> any descriptors will be not allocaled anymore so that NULL porinter
> > >> dereference happens after that on ravb_start_xmit().
> > >>
> > >> Such a case is possible to be caused because this driver supports
> > >> two queues (NC and BE) and the ravb_stop_dma() is possible to return
> > >> without any stopping process if TCCR or CSR register indicates
> > >> the hardware is operating for TX.
> > >>
> > >> To fix the issue, just try to wake the subqueue on
> > >> ravb_tx_timeout_work() if the descriptors are not full instead
> > >> of stop all transfers (all queues of TX and RX).
> > >>
> > >> [1]
> > >> https://lore.kernel.org/linux-renesas-soc/20200518045452.2390-1-dirk.behme@de.bosch.com/
> > >>
> > >> Reported-by: Dirk Behme <dirk.behme@...bosch.com>
> > >> Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@...esas.com>
> > >> ---
> > >>   I'm guessing that this issue is possible to happen if:
> > >>   - ravb_start_xmit() calls netif_stop_subqueue(), and
> > >>   - ravb_poll() will not be called with some reason, and
> > >>   - netif_wake_subqueue() will be not called, and then
> > >>   - dev_watchdog() in net/sched/sch_generic.c calls ndo_tx_timeout().
> > >>
> > >>   However, unfortunately, I didn't reproduce the issue yet.
> > >>   To be honest, I'm also guessing other queues (SR) of this hardware
> > >>   which out-of tree driver manages are possible to reproduce this issue,
> > >>   but I didn't try such environment for now...
> > >>
> > >>   So, I marked RFC on this patch now.
> > >
> > > I'm afraid, but do you have any comments about this patch?
> >
> >     I agree that we should now reset only the stuck queue, not both but I
> > doubt your solution is good enough. Let me have another look...
> 
> Thank you for your comment! I hope this solution is good enough...

I'm sorry again and again. But, do you have any time to look this patch?

Best regards,
Yoshihiro Shimoda