netdev - Re: net: fec: memory corruption caused by err_enet_mii

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 22 Dec 2021 11:33:33 +0100
From:   Andrew Lunn <andrew@...n.ch>
To:     Joakim Zhang <qiangqing.zhang@....com>
Cc:     Kegl Rohit <keglrohit@...il.com>, netdev <netdev@...r.kernel.org>
Subject: Re: net: fec: memory corruption caused by err_enet_mii_probe error
 path

> > err_enet_mii_probe:
> > fec_enet_free_buffers(ndev);
> > err_enet_alloc:
> > fec_enet_clk_enable(ndev, false);
> > clk_enable:
> > pm_runtime_mark_last_busy(&fep->pdev->dev);
> > pm_runtime_put_autosuspend(&fep->pdev->dev);
> > pinctrl_pm_select_sleep_state(&fep->pdev->dev);
> > return ret;
> > 
> > This error path frees the DMA buffers, BUT as far I could see it does not stop
> > the DMA engines.
> > => open() fails => frees buffers => DMA still active => MAC receives network
> > packet => DMA starts => random memory corruption (use after
> > free) => random kernel panics

> A question here, why receive path still active? MAC has not
> connected to PHY when this failure happened, should not see network
> activities.

Not every system has a PHY. There are plenty of boards with the FEC
directly connected to an Ethernet switch. So packets could be flowing.

	 Andrew