netdev - RE: [PATCH] net: renesas: sh_eth: Fix freeing wrong tx descriptor

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <TY2PR01MB36924BD44CA5B512B96AC2AFD8D49@TY2PR01MB3692.jpnprd01.prod.outlook.com>
Date:   Wed, 8 Sep 2021 11:43:24 +0000
From:   Yoshihiro Shimoda <yoshihiro.shimoda.uh@...esas.com>
To:     Sergey Shtylyov <s.shtylyov@....ru>,
        "davem@...emloft.net" <davem@...emloft.net>,
        "kuba@...nel.org" <kuba@...nel.org>
CC:     "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
        "linux-renesas-soc@...r.kernel.org" 
        <linux-renesas-soc@...r.kernel.org>
Subject: RE: [PATCH] net: renesas: sh_eth: Fix freeing wrong tx descriptor

Hi Sergey,

> From: Sergey Shtylyov, Sent: Wednesday, September 8, 2021 6:46 PM
> 
> On 08.09.2021 8:45, Yoshihiro Shimoda wrote:
> 
> >>> The cur_tx counter must be incremented after TACT bit of
> >>> txdesc->status was set. However, a CPU is possible to reorder
> >>> instructions and/or memory accesses between cur_tx and
> >>> txdesc->status. And then, if TX interrupt happened at such a
> >>> timing, the sh_eth_tx_free() may free the descriptor wrongly.
> >>> So, add wmb() before cur_tx++.
> >>
> >>     Not dma_wmb()? :-)
> >
> > On armv8, dma_wmb() is DMB OSHST, and wmb() is DSB ST.
> > IIUC, DMB OSHST is not affected the ordering of instructions.
> > So, we have to use wmb().
> 
>     I should really read up the ARM manuals on the barrier instructions... :-)

:)

> >>> Otherwise NETDEV WATCHDOG timeout is possible to happen.
> >>>
> >>> Fixes: 86a74ff21a7a ("net: sh_eth: add support for Renesas SuperH Ethernet")
> >>> Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@...esas.com>
> >>
> >> Reviewed-by: Sergey Shtylyov <s.shtylyov@....ru>
> >
> > Thank you for your review!
> 
>     Out of curiosity: have you really experienced the bug or found it by
> review?

Our team has really experienced the bug when iperf3 runs on both side(server and client),
and this patch could fix the issue.

Best regards,
Yoshihiro Shimoda

> > Best regards,
> > Yoshihiro Shimoda
> 
> MBR, Sergey