netdev - RE: [PATCH iwl-net v2 2/2] idpf: fix idpf_vc_core

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <MW4PR11MB5911A82DB0CBE070519439C9BA562@MW4PR11MB5911.namprd11.prod.outlook.com>
Date: Fri, 1 Nov 2024 23:00:06 +0000
From: "Singh, Krishneil K" <krishneil.k.singh@...el.com>
To: "Linga, Pavan Kumar" <pavan.kumar.linga@...el.com>,
	"intel-wired-lan@...ts.osuosl.org" <intel-wired-lan@...ts.osuosl.org>
CC: "netdev@...r.kernel.org" <netdev@...r.kernel.org>, "horms@...nel.org"
	<horms@...nel.org>, "Linga, Pavan Kumar" <pavan.kumar.linga@...el.com>,
	"stable@...r.kernel.org" <stable@...r.kernel.org>, "Singh, Tarun K"
	<tarun.k.singh@...el.com>
Subject: RE: [PATCH iwl-net v2 2/2] idpf: fix idpf_vc_core_init error path


> -----Original Message-----
> From: Pavan Kumar Linga <pavan.kumar.linga@...el.com>
> Sent: Friday, October 25, 2024 11:39 AM
> To: intel-wired-lan@...ts.osuosl.org
> Cc: netdev@...r.kernel.org; horms@...nel.org; Linga, Pavan Kumar
> <pavan.kumar.linga@...el.com>; stable@...r.kernel.org; Singh, Tarun K
> <tarun.k.singh@...el.com>
> Subject: [PATCH iwl-net v2 2/2] idpf: fix idpf_vc_core_init error path
> 
> In an event where the platform running the device control plane
> is rebooted, reset is detected on the driver. It releases
> all the resources and waits for the reset to complete. Once the
> reset is done, it tries to build the resources back. At this
> time if the device control plane is not yet started, then
> the driver timeouts on the virtchnl message and retries to
> establish the mailbox again.
> 
> In the retry flow, mailbox is deinitialized but the mailbox
> workqueue is still alive and polling for the mailbox message.
> This results in accessing the released control queue leading to
> null-ptr-deref. Fix it by unrolling the work queue cancellation
> and mailbox deinitialization in the reverse order which they got
> initialized.
> 
> Fixes: 4930fbf419a7 ("idpf: add core init and interrupt request")
> Fixes: 34c21fa894a1 ("idpf: implement virtchnl transaction manager")
> Cc: stable@...r.kernel.org # 6.9+
> Reviewed-by: Tarun K Singh <tarun.k.singh@...el.com>
> Signed-off-by: Pavan Kumar Linga <pavan.kumar.linga@...el.com>
> ---
> v2:
>  - remove changes which are not fixes for the actual issue from this patch
> ---
>  drivers/net/ethernet/intel/idpf/idpf_lib.c      | 1 +
>  drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | 1 -
>  2 files changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/net/ethernet/intel/idpf/idpf_lib.c
> b/drivers/net/ethernet/intel/idpf/idpf_lib.c
> index c3848e10e7db..b4fbb99bfad2 100644
> --- a/drivers/net/ethernet/intel/idpf/idpf_lib.c
> +++ b/drivers/net/ethernet/intel/idpf/idpf_lib.c

Tested-by: Krishneil Singh <krishneil.k.singh@...el.com>