netdev - Re: [PATCH RFC net-next] mlx5: fix for crash on net-next

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <b0967766-623a-90fa-3875-db9e1ad6a57f@gmail.com>
Date:   Tue, 23 Feb 2021 10:28:35 +0200
From:   Tariq Toukan <ttoukan.linux@...il.com>
To:     Jesper Dangaard Brouer <brouer@...hat.com>, netdev@...r.kernel.org,
        Saeed Mahameed <saeedm@...lanox.com>
Cc:     Jakub Kicinski <kuba@...nel.org>,
        "David S. Miller" <davem@...emloft.net>, saeedm@...dia.com,
        Tariq Toukan <tariqt@...lanox.com>, eranbe@...dia.com,
        maximmi@...lanox.com, Tariq Toukan <tariqt@...dia.com>,
        Saeed Mahameed <saeedm@...dia.com>
Subject: Re: [PATCH RFC net-next] mlx5: fix for crash on net-next



On 2/22/2021 9:50 PM, Jesper Dangaard Brouer wrote:
> Net-next at commit d310ec03a34e ("Merge tag 'perf-core-2021-02-17')
> 
> There is a divide error in drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
> where it seems that num_tc_x_num_ch can become zero in a modulo operation:
> 
> 	if (unlikely(txq_ix >= num_tc_x_num_ch))
> 		txq_ix %= num_tc_x_num_ch;
> 
> I think error were introduced in:
>   - 214baf22870c ("net/mlx5e: Support HTB offload")
> 
> The modulo operation was introduced in:
>   - 145e5637d941 ("net/mlx5e: Add TX PTP port object support")
> 
> The crash looks like this:
> 
> [   12.112849] divide error: 0000 [#1] PREEMPT SMP PTI
> [   12.117727] CPU: 4 PID: 0 Comm: swapper/4 Not tainted 5.11.0-net-next+ #575
> [   12.124677] Hardware name: Supermicro Super Server/X10SRi-F, BIOS 2.0a 08/01/2016
> [   12.132149] RIP: 0010:mlx5e_select_queue+0xd5/0x1e0 [mlx5_core]
> [   12.138110] Code: 85 c0 75 2e 48 83 bb 08 57 00 00 00 75 5b 31 d2 48 89 ee 48 89 df e8 ba 3e 54 e1 0f b7 d0 41 39 d4 0f 8f 6b ff ff ff 89 d0 99 <41> f7 fc e9 60 ff ff ff 8b 96 8c 00 00 00 89 d1 c1 e9 10 39 c1 0f
> [   12.156849] RSP: 0018:ffffc900001c0c10 EFLAGS: 00010297
> [   12.162065] RAX: 0000000000000004 RBX: ffff88810ff00000 RCX: 0000000000000007
> [   12.169188] RDX: 0000000000000000 RSI: ffff888107016400 RDI: ffff8881008dc740
> [   12.176313] RBP: ffff888107016400 R08: 0000000000000000 R09: 000000ncing: Fatal exception in interrupt ]---
> 
> This is an RFC, because I don't think this is a proper fix, but
> at least it allows me to boot with mlx5 driver enabled.
> 
> Signed-off-by: Jesper Dangaard Brouer <brouer@...hat.com>
> ---

Hi Jesper,

Thanks for your report and patch.

We'll check it and post the proper fix.
I wonder what's special in your configuration / use case, as I'm not 
aware of such failure.
Can you please share more info about the reproduction?

Regards,
Tariq