| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID:
<DM4PR21MB3536B7F200C702FDE7033C8BCE8F2@DM4PR21MB3536.namprd21.prod.outlook.com>
Date: Thu, 22 Aug 2024 02:21:10 +0000
From: Long Li <longli@...rosoft.com>
To: Haiyang Zhang <haiyangz@...rosoft.com>, "linux-hyperv@...r.kernel.org"
<linux-hyperv@...r.kernel.org>, "netdev@...r.kernel.org"
<netdev@...r.kernel.org>
CC: Dexuan Cui <decui@...rosoft.com>, "stephen@...workplumber.org"
<stephen@...workplumber.org>, KY Srinivasan <kys@...rosoft.com>, Paul
Rosswurm <paulros@...rosoft.com>, "olaf@...fle.de" <olaf@...fle.de>,
"vkuznets@...hat.com" <vkuznets@...hat.com>, "davem@...emloft.net"
<davem@...emloft.net>, "wei.liu@...nel.org" <wei.liu@...nel.org>,
"edumazet@...gle.com" <edumazet@...gle.com>, "kuba@...nel.org"
<kuba@...nel.org>, "pabeni@...hat.com" <pabeni@...hat.com>, "leon@...nel.org"
<leon@...nel.org>, "ssengar@...ux.microsoft.com"
<ssengar@...ux.microsoft.com>, "linux-rdma@...r.kernel.org"
<linux-rdma@...r.kernel.org>, "daniel@...earbox.net" <daniel@...earbox.net>,
"john.fastabend@...il.com" <john.fastabend@...il.com>, "bpf@...r.kernel.org"
<bpf@...r.kernel.org>, "ast@...nel.org" <ast@...nel.org>, "hawk@...nel.org"
<hawk@...nel.org>, "tglx@...utronix.de" <tglx@...utronix.de>,
"shradhagupta@...ux.microsoft.com" <shradhagupta@...ux.microsoft.com>,
"jesse.brandeburg@...el.com" <jesse.brandeburg@...el.com>,
"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
"stable@...r.kernel.org" <stable@...r.kernel.org>
Subject: RE: [PATCH net] net: mana: Fix race of mana_hwc_post_rx_wqe and new
hwc response
> Subject: [PATCH net] net: mana: Fix race of mana_hwc_post_rx_wqe and new
> hwc response
>
> The mana_hwc_rx_event_handler() / mana_hwc_handle_resp() calls
> complete(&ctx->comp_event) before posting the wqe back. It's possible that
> other callers, like mana_create_txq(), start the next round of
> mana_hwc_send_request() before the posting of wqe.
> And if the HW is fast enough to respond, it can hit no_wqe error on the HW
> channel, then the response message is lost. The mana driver may fail to create
> queues and open, because of waiting for the HW response and timed out.
> Sample dmesg:
> [ 528.610840] mana 39d4:00:02.0: HWC: Request timed out!
> [ 528.614452] mana 39d4:00:02.0: Failed to send mana message: -110, 0x0
> [ 528.618326] mana 39d4:00:02.0 enP14804s2: Failed to create WQ object: -110
>
> To fix it, move posting of rx wqe before complete(&ctx->comp_event).
>
> Cc: stable@...r.kernel.org
> Fixes: ca9c54d2d6a5 ("net: mana: Add a driver for Microsoft Azure Network
> Adapter (MANA)")
> Signed-off-by: Haiyang Zhang <haiyangz@...rosoft.com>
Reviewed-by: Long Li <longli@...rosoft.com>
> ---
> .../net/ethernet/microsoft/mana/hw_channel.c | 62 ++++++++++---------
> 1 file changed, 34 insertions(+), 28 deletions(-)
>
> diff --git a/drivers/net/ethernet/microsoft/mana/hw_channel.c
> b/drivers/net/ethernet/microsoft/mana/hw_channel.c
> index cafded2f9382..a00f915c5188 100644
> --- a/drivers/net/ethernet/microsoft/mana/hw_channel.c
> +++ b/drivers/net/ethernet/microsoft/mana/hw_channel.c
> @@ -52,9 +52,33 @@ static int mana_hwc_verify_resp_msg(const struct
> hwc_caller_ctx *caller_ctx,
> return 0;
> }
>
> +static int mana_hwc_post_rx_wqe(const struct hwc_wq *hwc_rxq,
> + struct hwc_work_request *req)
> +{
> + struct device *dev = hwc_rxq->hwc->dev;
> + struct gdma_sge *sge;
> + int err;
> +
> + sge = &req->sge;
> + sge->address = (u64)req->buf_sge_addr;
> + sge->mem_key = hwc_rxq->msg_buf->gpa_mkey;
> + sge->size = req->buf_len;
> +
> + memset(&req->wqe_req, 0, sizeof(struct gdma_wqe_request));
> + req->wqe_req.sgl = sge;
> + req->wqe_req.num_sge = 1;
> + req->wqe_req.client_data_unit = 0;
> +
> + err = mana_gd_post_and_ring(hwc_rxq->gdma_wq, &req->wqe_req,
> NULL);
> + if (err)
> + dev_err(dev, "Failed to post WQE on HWC RQ: %d\n", err);
> + return err;
> +}
> +
> static void mana_hwc_handle_resp(struct hw_channel_context *hwc, u32
> resp_len,
> - const struct gdma_resp_hdr *resp_msg)
> + struct hwc_work_request *rx_req)
> {
> + const struct gdma_resp_hdr *resp_msg = rx_req->buf_va;
> struct hwc_caller_ctx *ctx;
> int err;
>
> @@ -62,6 +86,7 @@ static void mana_hwc_handle_resp(struct
> hw_channel_context *hwc, u32 resp_len,
> hwc->inflight_msg_res.map)) {
> dev_err(hwc->dev, "hwc_rx: invalid msg_id = %u\n",
> resp_msg->response.hwc_msg_id);
> + mana_hwc_post_rx_wqe(hwc->rxq, rx_req);
> return;
> }
>
> @@ -75,30 +100,13 @@ static void mana_hwc_handle_resp(struct
> hw_channel_context *hwc, u32 resp_len,
> memcpy(ctx->output_buf, resp_msg, resp_len);
> out:
> ctx->error = err;
> - complete(&ctx->comp_event);
> -}
> -
> -static int mana_hwc_post_rx_wqe(const struct hwc_wq *hwc_rxq,
> - struct hwc_work_request *req)
> -{
> - struct device *dev = hwc_rxq->hwc->dev;
> - struct gdma_sge *sge;
> - int err;
> -
> - sge = &req->sge;
> - sge->address = (u64)req->buf_sge_addr;
> - sge->mem_key = hwc_rxq->msg_buf->gpa_mkey;
> - sge->size = req->buf_len;
>
> - memset(&req->wqe_req, 0, sizeof(struct gdma_wqe_request));
> - req->wqe_req.sgl = sge;
> - req->wqe_req.num_sge = 1;
> - req->wqe_req.client_data_unit = 0;
> + /* Must post rx wqe before complete(), otherwise the next rx may
> + * hit no_wqe error.
> + */
> + mana_hwc_post_rx_wqe(hwc->rxq, rx_req);
>
> - err = mana_gd_post_and_ring(hwc_rxq->gdma_wq, &req->wqe_req,
> NULL);
> - if (err)
> - dev_err(dev, "Failed to post WQE on HWC RQ: %d\n", err);
> - return err;
> + complete(&ctx->comp_event);
> }
>
> static void mana_hwc_init_event_handler(void *ctx, struct gdma_queue *q_self,
> @@ -235,14 +243,12 @@ static void mana_hwc_rx_event_handler(void *ctx,
> u32 gdma_rxq_id,
> return;
> }
>
> - mana_hwc_handle_resp(hwc, rx_oob->tx_oob_data_size, resp);
> + mana_hwc_handle_resp(hwc, rx_oob->tx_oob_data_size, rx_req);
>
> - /* Do no longer use 'resp', because the buffer is posted to the HW
> - * in the below mana_hwc_post_rx_wqe().
> + /* Can no longer use 'resp', because the buffer is posted to the HW
> + * in mana_hwc_handle_resp() above.
> */
> resp = NULL;
> -
> - mana_hwc_post_rx_wqe(hwc_rxq, rx_req);
> }
>
> static void mana_hwc_tx_event_handler(void *ctx, u32 gdma_txq_id,
> --
> 2.34.1
Powered by blists - more mailing lists