netdev - [PATCH] vmxnet3: disable rx data ring on dma allocation failure

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240528100615.30818-1-mstocker@barracuda.com>
Date: Tue, 28 May 2024 12:06:15 +0200
From: Matthias Stocker <mstocker@...racuda.com>
To: doshir@...are.com,
	pv-drivers@...are.com,
	netdev@...r.kernel.org
Cc: Matthias Stocker <mstocker@...racuda.com>
Subject: [PATCH] vmxnet3: disable rx data ring on dma allocation failure

When vmxnet3_rq_create fails to allocate memory for the data ring,
vmxnet3_rq_destroy_all_rxdataring is called, but rq->data_ring.desc_size
is not zeroed, as is the case when adapter->rxdataring_enabled is set to
false. This leads to the box crashing a short time later with a
NULL pointer dereference in memcpy.

[1101376.713751] vmxnet3 0000:13:00.0 dhcp: rx data ring will be disabled
[1101376.719942] vmxnet3 0000:13:00.0 dhcp: intr type 3, mode 0, 3 vectors allocated
[1101376.721085] vmxnet3 0000:13:00.0 dhcp: NIC Link is Up 10000 Mbps
[1101377.020907] BUG: kernel NULL pointer dereference, address: 0000000000000000
[1101377.023396] #PF: supervisor read access in kernel mode
[1101377.025172] #PF: error_code(0x0000) - not-present page
[1101377.026966] PGD 115a58067 P4D 115a58067 PUD 115a55067 PMD 0
[1101377.028930] Oops: 0000 [#1] SMP NOPTI
[1101377.033776] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020
[1101377.037316] RIP: 0010:__memcpy+0x12/0x20
[1101377.038700] Code: c0 74 0b 48 8b 78 08 31 f6 e8 ca 7d 86 ff eb c4 cc cc cc cc cc cc cc cc 0f 1f 44 00 00 48 89 f8 48 89 d1 48 c1 e9 03 83 e2 07 <f3> 48 a5 89 d1 f3 a4 e9 72 22 40 00 66 90 48 89 f8 48 89 d1 f3 a4
[1101377.044849] RSP: 0018:ffff991cc0003e70 EFLAGS: 00210202
[1101377.046639] RAX: ffff952ca8287e40 RBX: 0000000000000000 RCX: 0000000000000007
[1101377.049035] RDX: 0000000000000004 RSI: 0000000000000000 RDI: ffff952ca8287e40
[1101377.051449] RBP: ffff952c13c01180 R08: 0000000000000000 R09: 00000000000000c0
[1101377.053914] R10: ffff952c13c00980 R11: 0000000000000000 R12: ffff952d2b0a0000
[1101377.056358] R13: ffff952d16e10000 R14: ffff952d0cee0000 R15: 00000000ffffffff
[1101377.058773] FS:  0000000000000000(0000) GS:ffff952d3bc00000(0063) knlGS:00000000f79e3880
[1101377.061500] CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
[1101377.063488] CR2: 0000000000000000 CR3: 000000010dade000 CR4: 00000000000406f0
[1101377.065921] Call Trace:
[1101377.066844]  <IRQ>
[1101377.067621]  vmxnet3_rq_rx_complete+0x596/0xed0 [vmxnet3]
[1101377.072607]  vmxnet3_poll_rx_only+0x30/0xb0 [vmxnet3]
[1101377.074486]  net_rx_action+0x145/0x3e0
[1101377.075819]  __do_softirq+0xcb/0x28c
[1101377.077102]  asm_call_irq_on_stack+0x12/0x20
[1101377.078595]  </IRQ>
[1101377.079395]  do_softirq_own_stack+0x37/0x50
[1101377.080872]  irq_exit_rcu+0xc7/0x110
[1101377.082158]  common_interrupt+0x6c/0x120
[1101377.083547]  asm_common_interrupt+0x1e/0x40

Signed-off-by: Matthias Stocker <mstocker@...racuda.com>
---
 drivers/net/vmxnet3/vmxnet3_drv.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index 0578864792b6..beebe09eb88f 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -2034,8 +2034,8 @@ vmxnet3_rq_destroy_all_rxdataring(struct vmxnet3_adapter *adapter)
 					  rq->data_ring.base,
 					  rq->data_ring.basePA);
 			rq->data_ring.base = NULL;
-			rq->data_ring.desc_size = 0;
 		}
+		rq->data_ring.desc_size = 0;
 	}
 }
 
-- 
2.45.1