netdev - Re: [PATCH stable 4.19] net: systemport: Add global locking for descriptor lifecycle

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Mon, 20 Dec 2021 11:50:06 +0100
From:   Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To:     Florian Fainelli <f.fainelli@...il.com>
Cc:     stable@...r.kernel.org, Jakub Kicinski <kuba@...nel.org>,
        netdev@...r.kernel.org, Sasha Levin <sashal@...nel.org>,
        "David S. Miller" <davem@...emloft.net>
Subject: Re: [PATCH stable 4.19] net: systemport: Add global locking for
 descriptor lifecycle

On Sat, Dec 18, 2021 at 06:49:25PM -0800, Florian Fainelli wrote:
> commit 8b8e6e782456f1ce02a7ae914bbd5b1053f0b034 upstream
> 
> The descriptor list is a shared resource across all of the transmit queues, and
> the locking mechanism used today only protects concurrency across a given
> transmit queue between the transmit and reclaiming. This creates an opportunity
> for the SYSTEMPORT hardware to work on corrupted descriptors if we have
> multiple producers at once which is the case when using multiple transmit
> queues.
> 
> This was particularly noticeable when using multiple flows/transmit queues and
> it showed up in interesting ways in that UDP packets would get a correct UDP
> header checksum being calculated over an incorrect packet length. Similarly TCP
> packets would get an equally correct checksum computed by the hardware over an
> incorrect packet length.
> 
> The SYSTEMPORT hardware maintains an internal descriptor list that it re-arranges
> when the driver produces a new descriptor anytime it writes to the
> WRITE_PORT_{HI,LO} registers, there is however some delay in the hardware to
> re-organize its descriptors and it is possible that concurrent TX queues
> eventually break this internal allocation scheme to the point where the
> length/status part of the descriptor gets used for an incorrect data buffer.
> 
> The fix is to impose a global serialization for all TX queues in the short
> section where we are writing to the WRITE_PORT_{HI,LO} registers which solves
> the corruption even with multiple concurrent TX queues being used.
> 
> Fixes: 80105befdb4b ("net: systemport: add Broadcom SYSTEMPORT Ethernet MAC driver")
> Signed-off-by: Florian Fainelli <f.fainelli@...il.com>
> Link: https://lore.kernel.org/r/20211215202450.4086240-1-f.fainelli@gmail.com
> Signed-off-by: Jakub Kicinski <kuba@...nel.org>
> ---
>  drivers/net/ethernet/broadcom/bcmsysport.c | 5 +++++
>  drivers/net/ethernet/broadcom/bcmsysport.h | 1 +
>  2 files changed, 6 insertions(+)

All now queued up, thanks.

greg k-h