netdev - Re: [PATCH 1/2] ravb: Fix descriptor counters' conditions

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1879319092.816143.1627376136422@webmail.strato.com>
Date:   Tue, 27 Jul 2021 10:55:36 +0200 (CEST)
From:   Ulrich Hecht <uli@...nd.eu>
To:     Yoshihiro Shimoda <yoshihiro.shimoda.uh@...esas.com>,
        sergei.shtylyov@...il.com, davem@...emloft.net, kuba@...nel.org
Cc:     netdev@...r.kernel.org, linux-renesas-soc@...r.kernel.org
Subject: Re: [PATCH 1/2] ravb: Fix descriptor counters' conditions


> On 07/27/2021 10:21 AM Yoshihiro Shimoda <yoshihiro.shimoda.uh@...esas.com> wrote:
> 
>  
> The descriptor counters ({cur,dirty}_[rt]x) acts as free counters
> so that conditions are possible to be incorrect when a left value
> was overflowed.
> 
> So, for example, ravb_tx_free() could not free any descriptors
> because the following condition was checked as a signed value,
> and then "NETDEV WATCHDOG" happened:
> 
>     for (; priv->cur_tx[q] - priv->dirty_tx[q] > 0; priv->dirty_tx[q]++) {
> 
> To fix the issue, add get_num_desc() to calculate numbers of
> remaining descriptors.
> 
> Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper")
> Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@...esas.com>
> ---
>  drivers/net/ethernet/renesas/ravb_main.c | 22 +++++++++++++++-------
>  1 file changed, 15 insertions(+), 7 deletions(-)
> 
> diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
> index 805397088850..70fbac572036 100644
> --- a/drivers/net/ethernet/renesas/ravb_main.c
> +++ b/drivers/net/ethernet/renesas/ravb_main.c
> @@ -172,6 +172,14 @@ static const struct mdiobb_ops bb_ops = {
>  	.get_mdio_data = ravb_get_mdio_data,
>  };
>  
> +static u32 get_num_desc(u32 from, u32 subtract)
> +{
> +	if (from >= subtract)
> +		return from - subtract;
> +
> +	return U32_MAX - subtract + 1 + from;
> +}

This is a very roundabout way to implement an unsigned subtraction. :)
I think it would make more sense to simply return 0 if "subtract" is larger than "from".
(Likewise for sh_eth).

CU
Uli