lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <AM6PR08MB4376DF5C31C64EBFCB0276ECF7E99@AM6PR08MB4376.eurprd08.prod.outlook.com>
Date:   Tue, 27 Jul 2021 13:30:15 +0000
From:   Justin He <Justin.He@....com>
To:     Sasha Levin <sashal@...nel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "stable@...r.kernel.org" <stable@...r.kernel.org>
CC:     Lijian Zhang <Lijian.Zhang@....com>,
        "David S . Miller" <davem@...emloft.net>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>
Subject: RE: [PATCH AUTOSEL 5.13 09/21] qed: fix possible unpaired
 spin_{un}lock_bh in _qed_mcp_cmd_and_union()

Hi, Sasha

> -----Original Message-----
> From: Sasha Levin <sashal@...nel.org>
> Sent: Tuesday, July 27, 2021 9:19 PM
> To: linux-kernel@...r.kernel.org; stable@...r.kernel.org
> Cc: Justin He <Justin.He@....com>; Lijian Zhang <Lijian.Zhang@....com>;
> David S . Miller <davem@...emloft.net>; Sasha Levin <sashal@...nel.org>;
> netdev@...r.kernel.org
> Subject: [PATCH AUTOSEL 5.13 09/21] qed: fix possible unpaired
> spin_{un}lock_bh in _qed_mcp_cmd_and_union()
>
> From: Jia He <justin.he@....com>
If possible, please stop taking this commit to any stable version because
it has been reverted by later commit.

This patch is harmless but pointless.

Sorry for the inconvenience.

--
Cheers,
Justin (Jia He)


>
> [ Upstream commit 6206b7981a36476f4695d661ae139f7db36a802d ]
>
> Liajian reported a bug_on hit on a ThunderX2 arm64 server with FastLinQ
> QL41000 ethernet controller:
>  BUG: scheduling while atomic: kworker/0:4/531/0x00000200
>   [qed_probe:488()]hw prepare failed
>   kernel BUG at mm/vmalloc.c:2355!
>   Internal error: Oops - BUG: 0 [#1] SMP
>   CPU: 0 PID: 531 Comm: kworker/0:4 Tainted: G W 5.4.0-77-generic #86-
> Ubuntu
>   pstate: 00400009 (nzcv daif +PAN -UAO)
>  Call trace:
>   vunmap+0x4c/0x50
>   iounmap+0x48/0x58
>   qed_free_pci+0x60/0x80 [qed]
>   qed_probe+0x35c/0x688 [qed]
>   __qede_probe+0x88/0x5c8 [qede]
>   qede_probe+0x60/0xe0 [qede]
>   local_pci_probe+0x48/0xa0
>   work_for_cpu_fn+0x24/0x38
>   process_one_work+0x1d0/0x468
>   worker_thread+0x238/0x4e0
>   kthread+0xf0/0x118
>   ret_from_fork+0x10/0x18
>
> In this case, qed_hw_prepare() returns error due to hw/fw error, but in
> theory work queue should be in process context instead of interrupt.
>
> The root cause might be the unpaired spin_{un}lock_bh() in
> _qed_mcp_cmd_and_union(), which causes botton half is disabled incorrectly.
>
> Reported-by: Lijian Zhang <Lijian.Zhang@....com>
> Signed-off-by: Jia He <justin.he@....com>
> Signed-off-by: David S. Miller <davem@...emloft.net>
> Signed-off-by: Sasha Levin <sashal@...nel.org>
> ---
>  drivers/net/ethernet/qlogic/qed/qed_mcp.c | 23 +++++++++++++++++------
>  1 file changed, 17 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/net/ethernet/qlogic/qed/qed_mcp.c
> b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
> index cd882c453394..caeef25c89bb 100644
> --- a/drivers/net/ethernet/qlogic/qed/qed_mcp.c
> +++ b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
> @@ -474,14 +474,18 @@ _qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn,
>
>               spin_lock_bh(&p_hwfn->mcp_info->cmd_lock);
>
> -             if (!qed_mcp_has_pending_cmd(p_hwfn))
> +             if (!qed_mcp_has_pending_cmd(p_hwfn)) {
> +                     spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock);
>                       break;
> +             }
>
>               rc = qed_mcp_update_pending_cmd(p_hwfn, p_ptt);
> -             if (!rc)
> +             if (!rc) {
> +                     spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock);
>                       break;
> -             else if (rc != -EAGAIN)
> +             } else if (rc != -EAGAIN) {
>                       goto err;
> +             }
>
>               spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock);
>
> @@ -498,6 +502,8 @@ _qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn,
>               return -EAGAIN;
>       }
>
> +     spin_lock_bh(&p_hwfn->mcp_info->cmd_lock);
> +
>       /* Send the mailbox command */
>       qed_mcp_reread_offsets(p_hwfn, p_ptt);
>       seq_num = ++p_hwfn->mcp_info->drv_mb_seq;
> @@ -524,14 +530,18 @@ _qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn,
>
>               spin_lock_bh(&p_hwfn->mcp_info->cmd_lock);
>
> -             if (p_cmd_elem->b_is_completed)
> +             if (p_cmd_elem->b_is_completed) {
> +                     spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock);
>                       break;
> +             }
>
>               rc = qed_mcp_update_pending_cmd(p_hwfn, p_ptt);
> -             if (!rc)
> +             if (!rc) {
> +                     spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock);
>                       break;
> -             else if (rc != -EAGAIN)
> +             } else if (rc != -EAGAIN) {
>                       goto err;
> +             }
>
>               spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock);
>       } while (++cnt < max_retries);
> @@ -554,6 +564,7 @@ _qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn,
>               return -EAGAIN;
>       }
>
> +     spin_lock_bh(&p_hwfn->mcp_info->cmd_lock);
>       qed_mcp_cmd_del_elem(p_hwfn, p_cmd_elem);
>       spin_unlock_bh(&p_hwfn->mcp_info->cmd_lock);
>
> --
> 2.30.2

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ