netdev - Re: [PATCH v1 net 4/4] net: ena: Set tx

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <860d573e-09db-47b7-a9bf-8b915fef6a11@amd.com>
Date: Wed, 10 Apr 2024 14:53:01 -0700
From: "Nelson, Shannon" <shannon.nelson@....com>
To: darinzon@...zon.com, David Miller <davem@...emloft.net>,
 Jakub Kicinski <kuba@...nel.org>, netdev@...r.kernel.org
Cc: "Woodhouse, David" <dwmw@...zon.com>, "Machulsky, Zorik"
 <zorik@...zon.com>, "Matushevsky, Alexander" <matua@...zon.com>,
 Saeed Bshara <saeedb@...zon.com>, "Wilson, Matt" <msw@...zon.com>,
 "Liguori, Anthony" <aliguori@...zon.com>, "Bshara, Nafea"
 <nafea@...zon.com>, "Belgazal, Netanel" <netanel@...zon.com>,
 "Saidi, Ali" <alisaidi@...zon.com>, "Herrenschmidt, Benjamin"
 <benh@...zon.com>, "Kiyanovski, Arthur" <akiyano@...zon.com>,
 "Dagan, Noam" <ndagan@...zon.com>, "Agroskin, Shay" <shayagr@...zon.com>,
 "Itzko, Shahar" <itzko@...zon.com>, "Abboud, Osama" <osamaabb@...zon.com>,
 "Ostrovsky, Evgeny" <evostrov@...zon.com>, "Tabachnik, Ofir"
 <ofirt@...zon.com>, Netanel Belgazal <netanel@...apurnalabs.com>,
 Sameeh Jubran <sameehj@...zon.com>
Subject: Re: [PATCH v1 net 4/4] net: ena: Set tx_info->xdpf value to NULL

On 4/10/2024 2:13 AM, darinzon@...zon.com wrote:
> From: David Arinzon <darinzon@...zon.com>
> 
> The patch mentioned in the `Fixes` tag removed the explicit assignment
> of tx_info->xdpf to NULL with the justification that there's no need
> to set tx_info->xdpf to NULL and tx_info->num_of_bufs to 0 in case
> of a mapping error. Both values won't be used once the mapping function
> returns an error, and their values would be overridden by the next
> transmitted packet.
> 
> While both values do indeed get overridden in the next transmission
> call, the value of tx_info->xdpf is also used to check whether a TX
> descriptor's transmission has been completed (i.e. a completion for it
> was polled).
> 
> An example scenario:
> 1. Mapping failed, tx_info->xdpf wasn't set to NULL
> 2. A VF reset occurred leading to IO resource destruction and
>     a call to ena_free_tx_bufs() function
> 3. Although the descriptor whose mapping failed was freed by the
>     transmission function, it still passes the check
>       if (!tx_info->skb)
> 
>     (skb and xdp_frame are in a union)
> 4. The xdp_frame associated with the descriptor is freed twice
> 
> This patch returns the assignment of NULL to tx_info->xdpf to make the
> cleaning function knows that the descriptor is already freed.
> 
> Fixes: 504fd6a5390c ("net: ena: fix DMA mapping function issues in XDP")
> Signed-off-by: Shay Agroskin <shayagr@...zon.com>
> Signed-off-by: David Arinzon <darinzon@...zon.com>


Reviewed-by: Shannon Nelson <shannon.nelson@....com>


> ---
>   drivers/net/ethernet/amazon/ena/ena_xdp.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/net/ethernet/amazon/ena/ena_xdp.c b/drivers/net/ethernet/amazon/ena/ena_xdp.c
> index 337c435d..5b175e7e 100644
> --- a/drivers/net/ethernet/amazon/ena/ena_xdp.c
> +++ b/drivers/net/ethernet/amazon/ena/ena_xdp.c
> @@ -89,7 +89,7 @@ int ena_xdp_xmit_frame(struct ena_ring *tx_ring,
> 
>          rc = ena_xdp_tx_map_frame(tx_ring, tx_info, xdpf, &ena_tx_ctx);
>          if (unlikely(rc))
> -               return rc;
> +               goto err;
> 
>          ena_tx_ctx.req_id = req_id;
> 
> @@ -112,7 +112,9 @@ int ena_xdp_xmit_frame(struct ena_ring *tx_ring,
> 
>   error_unmap_dma:
>          ena_unmap_tx_buff(tx_ring, tx_info);
> +err:
>          tx_info->xdpf = NULL;
> +
>          return rc;
>   }
> 
> --
> 2.40.1
> 
>