netdev - Re: [PATCH net] net: mscc: ocelot: fix dropping of unknown IPv4 multicast on Seville

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20201205154358.0fdce3dd@kicinski-fedora-pc1c0hjn.DHCP.thefacebook.com>
Date:   Sat, 5 Dec 2020 15:43:58 -0800
From:   Jakub Kicinski <kuba@...nel.org>
To:     Alexandre Belloni <alexandre.belloni@...tlin.com>,
        Vladimir Oltean <vladimir.oltean@....com>
Cc:     "David S . Miller" <davem@...emloft.net>, netdev@...r.kernel.org,
        UNGLinuxDriver@...rochip.com, Andrew Lunn <andrew@...n.ch>,
        Florian Fainelli <f.fainelli@...il.com>,
        Vivien Didelot <vivien.didelot@...il.com>,
        Horatiu Vultur <horatiu.vultur@...rochip.com>,
        "Allan W . Nielsen" <allan.nielsen@...rochip.com>,
        Claudiu Manoil <claudiu.manoil@....com>,
        Steen Hegelund <steen.hegelund@...rochip.com>,
        Eldar Gasanov <eldargasanov2@...il.com>,
        Maxim Kochetkov <fido_max@...ox.ru>
Subject: Re: [PATCH net] net: mscc: ocelot: fix dropping of unknown IPv4
 multicast on Seville

On Fri, 4 Dec 2020 19:13:29 +0100 Alexandre Belloni wrote:
> On 04/12/2020 19:54:16+0200, Vladimir Oltean wrote:
> > The current assumption is that the felix DSA driver has flooding knobs
> > per traffic class, while ocelot switchdev has a single flooding knob.
> > This was correct for felix VSC9959 and ocelot VSC7514, but with the
> > introduction of seville VSC9953, we see a switch driven by felix.c which
> > has a single flooding knob.
> > 
> > So it is clear that we must do what should have been done from the
> > beginning, which is not to overwrite the configuration done by ocelot.c
> > in felix, but instead to teach the common ocelot library about the
> > differences in our switches, and set up the flooding PGIDs centrally.
> > 
> > The effect that the bogus iteration through FELIX_NUM_TC has upon
> > seville is quite dramatic. ANA_FLOODING is located at 0x00b548, and
> > ANA_FLOODING_IPMC is located at 0x00b54c. So the bogus iteration will
> > actually overwrite ANA_FLOODING_IPMC when attempting to write
> > ANA_FLOODING[1]. There is no ANA_FLOODING[1] in sevile, just ANA_FLOODING.
> > 
> > And when ANA_FLOODING_IPMC is overwritten with a bogus value, the effect
> > is that ANA_FLOODING_IPMC gets the value of 0x0003CF7D:
> > 	MC6_DATA = 61,
> > 	MC6_CTRL = 61,
> > 	MC4_DATA = 60,
> > 	MC4_CTRL = 0.
> > Because MC4_CTRL is zero, this means that IPv4 multicast control packets
> > are not flooded, but dropped. An invalid configuration, and this is how
> > the issue was actually spotted.
> > 
> > Reported-by: Eldar Gasanov <eldargasanov2@...il.com>
> > Reported-by: Maxim Kochetkov <fido_max@...ox.ru>
> > Tested-by: Eldar Gasanov <eldargasanov2@...il.com>
> > Fixes: 84705fc16552 ("net: dsa: felix: introduce support for Seville VSC9953 switch")
> > Fixes: 3c7b51bd39b2 ("net: dsa: felix: allow flooding for all traffic classes")
> > Signed-off-by: Vladimir Oltean <vladimir.oltean@....com>  
> Reviewed-by: Alexandre Belloni <alexandre.belloni@...tlin.com>

Applied, thanks!