netdev - [PATCH net v4] net: b44: set pause params only when interface is up

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: 
 <PH0PR18MB44741DFBDDF3AA7ADB9F2DDADE172@PH0PR18MB4474.namprd18.prod.outlook.com>
Date: Thu, 25 Apr 2024 05:20:35 +0000
From: Hariprasad Kelam <hkelam@...vell.com>
To: Peter Münster <pm@...n.net>,
        "netdev@...r.kernel.org"
	<netdev@...r.kernel.org>
CC: Michael Chan <michael.chan@...adcom.com>
Subject: [PATCH net v4] net: b44: set pause params only when interface is up


Understood, this patch fixes the panic issue.
 See inline for few comments,

> b44_free_rings() accesses b44::rx_buffers (and ::tx_buffers) unconditionally,
> but b44::rx_buffers is only valid when the device is up (they get allocated in
> b44_open(), and deallocated again in b44_close()), any other time these are
> just a NULL pointers.
> 
> So if you try to change the pause params while the network interface is
> disabled/administratively down, everything explodes (which likely netifd tries
> to do).
> 
> Link: https://github.com/openwrt/openwrt/issues/13789
> Fixes: 1da177e4c3f4 (Linux-2.6.12-rc2)
> Cc: stable@...r.kernel.org
> Reported-by: Peter Münster <pm@...n.net>
> Suggested-by: Jonas Gorski <jonas.gorski@...il.com>
> Signed-off-by: Vaclav Svoboda <svoboda@...g.cz>
> Tested-by: Peter Münster <pm@...n.net>
> Reviewed-by: Andrew Lunn <andrew@...n.ch>
> Signed-off-by: Peter Münster <pm@...n.net>
> ---
>  drivers/net/ethernet/broadcom/b44.c | 14 ++++++++------
>  1 file changed, 8 insertions(+), 6 deletions(-)
> 
> diff --git a/drivers/net/ethernet/broadcom/b44.c
> b/drivers/net/ethernet/broadcom/b44.c
> index 3e4fb3c3e834..1be6d14030bc 100644
> --- a/drivers/net/ethernet/broadcom/b44.c
> +++ b/drivers/net/ethernet/broadcom/b44.c
> @@ -2009,12 +2009,14 @@ static int b44_set_pauseparam(struct net_device
> *dev,
>  		bp->flags |= B44_FLAG_TX_PAUSE;
>  	else
>  		bp->flags &= ~B44_FLAG_TX_PAUSE;
> -	if (bp->flags & B44_FLAG_PAUSE_AUTO) {
> -		b44_halt(bp);
> -		b44_init_rings(bp);
> -		b44_init_hw(bp, B44_FULL_RESET);
> -	} else {
> -		__b44_set_flow_ctrl(bp, bp->flags);
> +	if (netif_running(dev)) {
> +		if (bp->flags & B44_FLAG_PAUSE_AUTO) {
> +			b44_halt(bp);
> +			b44_init_rings(bp);
> +			b44_init_hw(bp, B44_FULL_RESET);
> +		} else {
> +			__b44_set_flow_ctrl(bp, bp->flags);
> +		}
>  	}
The actual register config to enable pause frame is protected with "netif_running", does driver need to
reject the request if interface is down.
Otherwise, there is mismatch if someone reads pause frame status (b44_get_pauseparam).


Thanks,
Hariprasad k
>  	spin_unlock_irq(&bp->lock);
> 
> --
> 2.35.3