netdev - Re: [PATCH net] ice: fix rx buffers handling for flow director packets

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <ZAXmm4R6HgiKXSLh@corigine.com>
Date:   Mon, 6 Mar 2023 14:11:55 +0100
From:   Simon Horman <simon.horman@...igine.com>
To:     Piotr Raczynski <piotr.raczynski@...el.com>
Cc:     netdev@...r.kernel.org, maciej.fijalkowski@...el.com,
        michal.swiatkowski@...el.com, lukasz.czapnik@...el.com,
        anthony.l.nguyen@...el.com
Subject: Re: [PATCH net] ice: fix rx buffers handling for flow director
 packets

On Mon, Mar 06, 2023 at 11:20:24AM +0100, Piotr Raczynski wrote:
> Adding flow director filters stopped working correctly after
> commit 2fba7dc5157b ("ice: Add support for XDP multi-buffer
> on Rx side"). As a result, only first flow director filter
> can be added, adding next filter leads to NULL pointer
> dereference attached below.
> 
> Rx buffer handling and reallocation logic has been optimized,
> however flow director specific traffic was not accounted for.
> As a result driver handled those packets incorrectly since new
> logic was based on ice_rx_ring::first_desc which was not set
> in this case.
> 
> Fix this by setting struct ice_rx_ring::first_desc to next_to_clean
> for flow director received packets.
> 
> [  438.544867] BUG: kernel NULL pointer dereference, address: 0000000000000000
> [  438.551840] #PF: supervisor read access in kernel mode
> [  438.556978] #PF: error_code(0x0000) - not-present page
> [  438.562115] PGD 7c953b2067 P4D 0
> [  438.565436] Oops: 0000 [#1] PREEMPT SMP NOPTI
> [  438.569794] CPU: 0 PID: 0 Comm: swapper/0 Kdump: loaded Not tainted 6.2.0-net-bug #1
> [  438.577531] Hardware name: Intel Corporation M50CYP2SBSTD/M50CYP2SBSTD, BIOS SE5C620.86B.01.01.0005.2202160810 02/16/2022
> [  438.588470] RIP: 0010:ice_clean_rx_irq+0x2b9/0xf20 [ice]
> [  438.593860] Code: 45 89 f7 e9 ac 00 00 00 8b 4d 78 41 31 4e 10 41 09 d5 4d 85 f6 0f 84 82 00 00 00 49 8b 4e 08 41 8b 76
> 1c 65 8b 3d 47 36 4a 3f <48> 8b 11 48 c1 ea 36 39 d7 0f 85 a6 00 00 00 f6 41 08 02 0f 85 9c
> [  438.612605] RSP: 0018:ff8c732640003ec8 EFLAGS: 00010082
> [  438.617831] RAX: 0000000000000800 RBX: 00000000000007ff RCX: 0000000000000000
> [  438.624957] RDX: 0000000000000800 RSI: 0000000000000000 RDI: 0000000000000000
> [  438.632089] RBP: ff4ed275a2158200 R08: 00000000ffffffff R09: 0000000000000020
> [  438.639222] R10: 0000000000000000 R11: 0000000000000020 R12: 0000000000001000
> [  438.646356] R13: 0000000000000000 R14: ff4ed275d0daffe0 R15: 0000000000000000
> [  438.653485] FS:  0000000000000000(0000) GS:ff4ed2738fa00000(0000) knlGS:0000000000000000
> [  438.661563] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [  438.667310] CR2: 0000000000000000 CR3: 0000007c9f0d6006 CR4: 0000000000771ef0
> [  438.674444] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> [  438.681573] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> [  438.688697] PKRU: 55555554
> [  438.691404] Call Trace:
> [  438.693857]  <IRQ>
> [  438.695877]  ? profile_tick+0x17/0x80
> [  438.699542]  ice_msix_clean_ctrl_vsi+0x24/0x50 [ice]
> [  438.702571] ice 0000:b1:00.0: VF 1: ctrl_vsi irq timeout
> [  438.704542]  __handle_irq_event_percpu+0x43/0x1a0
> [  438.704549]  handle_irq_event+0x34/0x70
> [  438.704554]  handle_edge_irq+0x9f/0x240
> [  438.709901] iavf 0000:b1:01.1: Failed to add Flow Director filter with status: 6
> [  438.714571]  __common_interrupt+0x63/0x100
> [  438.714580]  common_interrupt+0xb4/0xd0
> [  438.718424] iavf 0000:b1:01.1: Rule ID: 127 dst_ip: 0.0.0.0 src_ip 0.0.0.0 UDP: dst_port 4 src_port 0
> [  438.722255]  </IRQ>
> [  438.722257]  <TASK>
> [  438.722257]  asm_common_interrupt+0x22/0x40
> [  438.722262] RIP: 0010:cpuidle_enter_state+0xc8/0x430
> [  438.722267] Code: 6e e9 25 ff e8 f9 ef ff ff 8b 53 04 49 89 c5 0f 1f 44 00 00 31 ff e8 d7 f1 24 ff 45
> 84 ff 0f 85 57 02 00 00 fb 0f 1f 44 00 00 <45> 85 f6 0f 88 85 01 00 00 49 63 d6 48 8d 04 52 48 8d 04 82 49 8d
> [  438.722269] RSP: 0018:ffffffff86003e50 EFLAGS: 00000246
> [  438.784108] RAX: ff4ed2738fa00000 RBX: ffbe72a64fc01020 RCX: 0000000000000000
> [  438.791234] RDX: 0000000000000000 RSI: ffffffff858d84de RDI: ffffffff85893641
> [  438.798365] RBP: 0000000000000002 R08: 0000000000000002 R09: 000000003158af9d
> [  438.805490] R10: 0000000000000008 R11: 0000000000000354 R12: ffffffff862365a0
> [  438.812622] R13: 000000661b472a87 R14: 0000000000000002 R15: 0000000000000000
> [  438.819757]  cpuidle_enter+0x29/0x40
> [  438.823333]  do_idle+0x1b6/0x230
> [  438.826566]  cpu_startup_entry+0x19/0x20
> [  438.830492]  rest_init+0xcb/0xd0
> [  438.833717]  arch_call_rest_init+0xa/0x30
> [  438.837731]  start_kernel+0x776/0xb70
> [  438.841396]  secondary_startup_64_no_verify+0xe5/0xeb
> [  438.846449]  </TASK>
> 
> Fixes: 2fba7dc5157b ("ice: Add support for XDP multi-buffer on Rx side")
> Signed-off-by: Piotr Raczynski <piotr.raczynski@...el.com>
> Acked-by: Maciej Fijalkowski <maciej.fijalkowski@...el.com>

Reviewed-by: Simon Horman <simon.horman@...igine.com>