netdev - [PATCH RFC net] virtio-net: add timeout for virtnet_send

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Tue, 18 Jul 2023 12:09:20 -0700
From: Shannon Nelson <shannon.nelson@....com>
To: <shannon.nelson@....com>, <davem@...emloft.net>, <netdev@...r.kernel.org>,
	<kuba@...nel.org>, <mst@...hat.com>, <jasowang@...hat.com>,
	<virtualization@...ts.linux-foundation.org>
CC: <drivers@...sando.io>, <brett.creeley@....com>
Subject: [PATCH RFC net] virtio-net: add timeout for virtnet_send_command()

When trying to talk to a device that has gone out to lunch, the
virtnet_send_command() will sit and spin forever, causing a soft
lockup and eventually crashing the kernel.  Add a limit to the
spin and return false if we hit the timeout.  The 2 second time
limit seems a bit arbitrary, but a reasonable place to start.

This is a little more brute force than Jason's suggestions in [1],
but at least prevents the soft lockups and eventual kernel crash
that we were seeing in testing.

[1]: https://lore.kernel.org/netdev/20230524081842.3060-1-jasowang@redhat.com/

Fixes: 2a41f71d3bd9 ("virtio_net: Add a virtqueue for outbound control commands")
Signed-off-by: Shannon Nelson <shannon.nelson@....com>
---
 drivers/net/virtio_net.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 0db14f6b87d3..c3bf1c9f3244 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -2264,6 +2264,8 @@ static bool virtnet_send_command(struct virtnet_info *vi, u8 class, u8 cmd,
 {
 	struct scatterlist *sgs[4], hdr, stat;
 	unsigned out_num = 0, tmp;
+	unsigned long deadline;
+	bool timeout;
 	int ret;
 
 	/* Caller should know better */
@@ -2297,11 +2299,16 @@ static bool virtnet_send_command(struct virtnet_info *vi, u8 class, u8 cmd,
 	/* Spin for a response, the kick causes an ioport write, trapping
 	 * into the hypervisor, so the request should be handled immediately.
 	 */
+	deadline = jiffies + 2 * HZ;
+	timeout = false;
 	while (!virtqueue_get_buf(vi->cvq, &tmp) &&
-	       !virtqueue_is_broken(vi->cvq))
+	       !virtqueue_is_broken(vi->cvq) &&
+	       !timeout) {
 		cpu_relax();
+		timeout = time_after(jiffies, deadline);
+	}
 
-	return vi->ctrl->status == VIRTIO_NET_OK;
+	return vi->ctrl->status == VIRTIO_NET_OK && !timeout;
 }
 
 static int virtnet_set_mac_address(struct net_device *dev, void *p)
-- 
2.17.1