netdev - Re: [PATCH iwl-net] ice: fix usage of logical PF id

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20251008122101.GQ3060232@horms.kernel.org>
Date: Wed, 8 Oct 2025 13:21:01 +0100
From: Simon Horman <horms@...nel.org>
To: Grzegorz Nitka <grzegorz.nitka@...el.com>
Cc: intel-wired-lan@...ts.osuosl.org, netdev@...r.kernel.org,
	Dan Nowlin <dan.nowlin@...el.com>,
	Aleksandr Loktionov <aleksandr.loktionov@...el.com>,
	Przemek Kitszel <przemyslaw.kitszel@...el.com>
Subject: Re: [PATCH iwl-net] ice: fix usage of logical PF id

On Wed, Oct 08, 2025 at 12:28:53PM +0200, Grzegorz Nitka wrote:
> In some devices, the function numbers used are non-contiguous. For
> example, here is such configuration for E825 device:
> 
> root@...me/root# lspci -v | grep Eth
> 0a:00.0 Ethernet controller: Intel Corporation Ethernet Connection
> E825-C for backplane (rev 04)
> 0a:00.1 Ethernet controller: Intel Corporation Ethernet Connection
> E825-C for backplane (rev 04)
> 0a:00.4 Ethernet controller: Intel Corporation Ethernet Connection
> E825-C 10GbE (rev 04)
> 0a:00.5 Ethernet controller: Intel Corporation Ethernet Connection
> E825-C 10GbE (rev 04)
> 
> When distributing RSS and FDIR masks, which are global resources across
> the active devices, it is required to have a contiguous PF id, which can
> be described as a logical PF id. In the case above, function 0 would
> have a logical PF id of 0, function 1 would have a logical PF id
> of 1, and functions 4 and 5 would have a logical PF ids 2 and 3
> respectively.
> Using logical PF id can properly describe which slice of resources can
> be used by a particular PF.
> 
> The 'function id' to 'logical id' mapping has been introduced with the
> commit 015307754a19 ("ice: Support VF queue rate limit and quanta size
> configuration"). However, the usage of 'logical_pf_id' field was
> unintentionally skipped for profile mask configuration.
> Fix it by using 'logical_pf_id' instead of 'pf_id' value when configuring
> masks.
> 
> Without that patch, wrong indexes, i.e. out of range for given PF, can
> be used while configuring resources masks, which might lead to memory
> corruption and undefined driver behavior.
> The call trace below is one of the examples of such error:
> 
> [  +0.000008] WARNING: CPU: 39 PID: 3830 at drivers/base/devres.c:1095
> devm_kfree+0x70/0xa0
> [  +0.000002] RIP: 0010:devm_kfree+0x70/0xa0
> [  +0.000001] Call Trace:
> [  +0.000002]  <TASK>
> [  +0.000002]  ice_free_hw_tbls+0x183/0x710 [ice]
> [  +0.000106]  ice_deinit_hw+0x67/0x90 [ice]
> [  +0.000091]  ice_deinit+0x20d/0x2f0 [ice]
> [  +0.000076]  ice_remove+0x1fa/0x6a0 [ice]
> [  +0.000075]  pci_device_remove+0xa7/0x1d0
> [  +0.000010]  device_release_driver_internal+0x365/0x530
> [  +0.000006]  driver_detach+0xbb/0x170
> [  +0.000003]  bus_remove_driver+0x117/0x290
> [  +0.000007]  pci_unregister_driver+0x26/0x250
> 
> Fixes: 015307754a19 ("ice: Support VF queue rate limit and quanta size configuration")
> Suggested-by: Dan Nowlin <dan.nowlin@...el.com>
> Signed-off-by: Grzegorz Nitka <grzegorz.nitka@...el.com>
> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@...el.com>
> Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@...el.com>

Reviewed-by: Simon Horman <horms@...nel.org>