DPDK patches and discussions
 help / color / mirror / Atom feed
* [PATCH] net/vmxnet3: Fix vmxnet3 NULL pointer deref after configuration failure
@ 2024-10-26 14:33 Roger B Melton
  2024-10-27  8:43 ` Morten Brørup
  0 siblings, 1 reply; 2+ messages in thread
From: Roger B Melton @ 2024-10-26 14:33 UTC (permalink / raw)
  To: Jochen Behrens; +Cc: dev, Roger B Melton

Problem:

If vxmnet3_dev_configure() fails, applications may call
vmxnet3_dev_close(). If the failure occurs before the vmxnet3
hw->shared structure is allocated the close will lead to a segv.

Root Cause:

This crash is due to incorrect adapter_stopped state in the
vmxnet3 dev_private structure. When dev_private is allocated,
adapter_stopped will be 0 (FALSE).  eth_vmxnet3_dev_init() does not
set it to TRUE, so it will remain FALSE until a successful
vmxnet3_dev_start() followed by a vmxnet3_dev_stop().  When
vmxnet3_dev_close() is called, it will invoke vmxnet3_dev_stop().
vmxnet3_dev_stop() will check the adapter_stopped state in the
vmxnet3 shared data, find it is FALSE and will proceed to stop the
device, calling vmxnet3_disable_all_intrs().
vmxnet3_disable_all_intrs() attempts to access the vmxnet3 shared data
resulting in the segv.

Solution:

Set adapter_stopped to TRUE in eth_vmxnet3_dev_init(), to prevent stop
processing.

Signed-off-by: Roger B Melton <rmelton@cisco.com>
---
 drivers/net/vmxnet3/vmxnet3_ethdev.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/vmxnet3/vmxnet3_ethdev.c b/drivers/net/vmxnet3/vmxnet3_ethdev.c
index 467fb61137..8d7f95a753 100644
--- a/drivers/net/vmxnet3/vmxnet3_ethdev.c
+++ b/drivers/net/vmxnet3/vmxnet3_ethdev.c
@@ -403,6 +403,7 @@ eth_vmxnet3_dev_init(struct rte_eth_dev *eth_dev)
 	/* Vendor and Device ID need to be set before init of shared code */
 	hw->device_id = pci_dev->id.device_id;
 	hw->vendor_id = pci_dev->id.vendor_id;
+	hw->adapter_stopped = TRUE;
 	hw->hw_addr0 = (void *)pci_dev->mem_resource[0].addr;
 	hw->hw_addr1 = (void *)pci_dev->mem_resource[1].addr;
 
-- 
2.47.0


^ permalink raw reply	[flat|nested] 2+ messages in thread

* RE: [PATCH] net/vmxnet3: Fix vmxnet3 NULL pointer deref after configuration failure
  2024-10-26 14:33 [PATCH] net/vmxnet3: Fix vmxnet3 NULL pointer deref after configuration failure Roger B Melton
@ 2024-10-27  8:43 ` Morten Brørup
  0 siblings, 0 replies; 2+ messages in thread
From: Morten Brørup @ 2024-10-27  8:43 UTC (permalink / raw)
  To: Roger B Melton, Jochen Behrens; +Cc: dev, Ronak Doshi

> From: Roger B Melton [mailto:rmelton@cisco.com]
> Sent: Saturday, 26 October 2024 16.34
> 
> Problem:
> 
> If vxmnet3_dev_configure() fails, applications may call
> vmxnet3_dev_close(). If the failure occurs before the vmxnet3
> hw->shared structure is allocated the close will lead to a segv.
> 
> Root Cause:
> 
> This crash is due to incorrect adapter_stopped state in the
> vmxnet3 dev_private structure. When dev_private is allocated,
> adapter_stopped will be 0 (FALSE).  eth_vmxnet3_dev_init() does not
> set it to TRUE, so it will remain FALSE until a successful
> vmxnet3_dev_start() followed by a vmxnet3_dev_stop().  When
> vmxnet3_dev_close() is called, it will invoke vmxnet3_dev_stop().
> vmxnet3_dev_stop() will check the adapter_stopped state in the
> vmxnet3 shared data, find it is FALSE and will proceed to stop the
> device, calling vmxnet3_disable_all_intrs().
> vmxnet3_disable_all_intrs() attempts to access the vmxnet3 shared data
> resulting in the segv.
> 
> Solution:
> 
> Set adapter_stopped to TRUE in eth_vmxnet3_dev_init(), to prevent stop
> processing.
> 
> Signed-off-by: Roger B Melton <rmelton@cisco.com>
> ---
>  drivers/net/vmxnet3/vmxnet3_ethdev.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/net/vmxnet3/vmxnet3_ethdev.c
> b/drivers/net/vmxnet3/vmxnet3_ethdev.c
> index 467fb61137..8d7f95a753 100644
> --- a/drivers/net/vmxnet3/vmxnet3_ethdev.c
> +++ b/drivers/net/vmxnet3/vmxnet3_ethdev.c
> @@ -403,6 +403,7 @@ eth_vmxnet3_dev_init(struct rte_eth_dev *eth_dev)
>  	/* Vendor and Device ID need to be set before init of shared code
> */
>  	hw->device_id = pci_dev->id.device_id;
>  	hw->vendor_id = pci_dev->id.vendor_id;
> +	hw->adapter_stopped = TRUE;
>  	hw->hw_addr0 = (void *)pci_dev->mem_resource[0].addr;
>  	hw->hw_addr1 = (void *)pci_dev->mem_resource[1].addr;
> 
> --
> 2.47.0

Acked-by: Morten Brørup <mb@smartsharesystems.com>


^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, other threads:[~2024-10-27  8:43 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2024-10-26 14:33 [PATCH] net/vmxnet3: Fix vmxnet3 NULL pointer deref after configuration failure Roger B Melton
2024-10-27  8:43 ` Morten Brørup

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).