netdev - Re: [PATCH net 2/2] bnxt: don't enable NAPI until rings are ready

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 26 Aug 2020 13:23:33 -0700
From:   Michael Chan <michael.chan@...adcom.com>
To:     Jakub Kicinski <kuba@...nel.org>
Cc:     David Miller <davem@...emloft.net>,
        Eric Dumazet <eric.dumazet@...il.com>,
        Netdev <netdev@...r.kernel.org>,
        Kernel Team <kernel-team@...com>, Rob Sherwood <rsher@...com>
Subject: Re: [PATCH net 2/2] bnxt: don't enable NAPI until rings are ready

On Wed, Aug 26, 2020 at 12:40 PM Jakub Kicinski <kuba@...nel.org> wrote:
>
> Netpoll can try to poll napi as soon as napi_enable() is called.
> It crashes trying to access a doorbell which is still NULL:
>
>  BUG: kernel NULL pointer dereference, address: 0000000000000000
>  CPU: 59 PID: 6039 Comm: ethtool Kdump: loaded Tainted: G S                5.9.0-rc1-00469-g5fd99b5d9950-dirty #26
>  RIP: 0010:bnxt_poll+0x121/0x1c0
>  Code: c4 20 44 89 e0 5b 5d 41 5c 41 5d 41 5e 41 5f c3 41 8b 86 a0 01 00 00 41 23 85 18 01 00 00 49 8b 96 a8 01 00 00 0d 00 00 00 24 <89> 02
> 41 f6 45 77 02 74 cb 49 8b ae d8 01 00 00 31 c0 c7 44 24 1a
>   netpoll_poll_dev+0xbd/0x1a0
>   __netpoll_send_skb+0x1b2/0x210
>   netpoll_send_udp+0x2c9/0x406
>   write_ext_msg+0x1d7/0x1f0
>   console_unlock+0x23c/0x520
>   vprintk_emit+0xe0/0x1d0
>   printk+0x58/0x6f
>   x86_vector_activate.cold+0xf/0x46
>   __irq_domain_activate_irq+0x50/0x80
>   __irq_domain_activate_irq+0x32/0x80
>   __irq_domain_activate_irq+0x32/0x80
>   irq_domain_activate_irq+0x25/0x40
>   __setup_irq+0x2d2/0x700
>   request_threaded_irq+0xfb/0x160
>   __bnxt_open_nic+0x3b1/0x750
>   bnxt_open_nic+0x19/0x30
>   ethtool_set_channels+0x1ac/0x220
>   dev_ethtool+0x11ba/0x2240
>   dev_ioctl+0x1cf/0x390
>   sock_do_ioctl+0x95/0x130
>
> Reported-by: Rob Sherwood <rsher@...com>
> Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.")
> Signed-off-by: Jakub Kicinski <kuba@...nel.org>

Reviewed-by: Michael Chan <michael.chan@...adcom.com>

Thanks.