lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-Id: <20250807-jk-ice-fix-tx-tstamp-race-v1-0-730fe20bec11@intel.com>
Date: Thu, 07 Aug 2025 10:35:25 -0700
From: Jacob Keller <jacob.e.keller@...el.com>
To: Przemek Kitszel <przemyslaw.kitszel@...el.com>, 
 Intel Wired LAN <intel-wired-lan@...ts.osuosl.org>, netdev@...r.kernel.org
Cc: Jacob Keller <jacob.e.keller@...el.com>
Subject: [PATCH iwl-net 0/2] ice: fix NULL access of tx->in_use

Recent versions of the E810 firmware have support for a "low latency"
interface for accessing Tx timestamps without interacting over the AdminQ.

Unfortunately, a couple of the functions involved with this logic don't
properly check if the Tx timestamp tracker is initialized. This can lead to
a use-after-free or NULL pointer access violation:

[245977.278756] BUG: kernel NULL pointer dereference, address: 0000000000000000
[245977.278774] RIP: 0010:_find_first_bit+0x19/0x40
[245977.278796] Call Trace:
[245977.278809]  ? ice_misc_intr+0x364/0x380 [ice]

This happens because the reset flow in the driver re-initializes the
tracker. If a Tx timestamp interrupt occurs concurrently with a reset, the
ineractions race and the crash can occur.

I split the fixes to two separate patches because the extra interrupt for
low latency came in a different kernel. Hopefully this aids with
backporting the fix.

This was originally reported on an older kernel prior to f9472aaabd1f
("ice: Process TSYN IRQ in a separate function"), which has a similar bug,
but at a different code point. I plan to look into if any stable kernels
need a separate fix after this.

Signed-off-by: Jacob Keller <jacob.e.keller@...el.com>
---
Jacob Keller (2):
      ice: fix NULL access of tx->in_use in ice_ptp_ts_irq
      ice: fix NULL access of tx->in_use in ice_ll_ts_intr

 drivers/net/ethernet/intel/ice/ice_main.c | 12 +++++++-----
 drivers/net/ethernet/intel/ice/ice_ptp.c  | 13 ++++++++-----
 2 files changed, 15 insertions(+), 10 deletions(-)
---
base-commit: d942fe13f72bec92f6c689fbd74c5ec38228c16a
change-id: 20250807-jk-ice-fix-tx-tstamp-race-5fe8484670a4

Best regards,
--  
Jacob Keller <jacob.e.keller@...el.com>


Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ