* [PATCH] net/vmxnet3: Fix vmxnet3 NULL pointer deref after configuration failure
@ 2024-10-26 14:33 Roger B Melton
2024-10-27 8:43 ` Morten Brørup
2024-10-30 3:15 ` Ferruh Yigit
0 siblings, 2 replies; 6+ messages in thread
From: Roger B Melton @ 2024-10-26 14:33 UTC (permalink / raw)
To: Jochen Behrens; +Cc: dev, Roger B Melton
Problem:
If vxmnet3_dev_configure() fails, applications may call
vmxnet3_dev_close(). If the failure occurs before the vmxnet3
hw->shared structure is allocated the close will lead to a segv.
Root Cause:
This crash is due to incorrect adapter_stopped state in the
vmxnet3 dev_private structure. When dev_private is allocated,
adapter_stopped will be 0 (FALSE). eth_vmxnet3_dev_init() does not
set it to TRUE, so it will remain FALSE until a successful
vmxnet3_dev_start() followed by a vmxnet3_dev_stop(). When
vmxnet3_dev_close() is called, it will invoke vmxnet3_dev_stop().
vmxnet3_dev_stop() will check the adapter_stopped state in the
vmxnet3 shared data, find it is FALSE and will proceed to stop the
device, calling vmxnet3_disable_all_intrs().
vmxnet3_disable_all_intrs() attempts to access the vmxnet3 shared data
resulting in the segv.
Solution:
Set adapter_stopped to TRUE in eth_vmxnet3_dev_init(), to prevent stop
processing.
Signed-off-by: Roger B Melton <rmelton@cisco.com>
---
drivers/net/vmxnet3/vmxnet3_ethdev.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/vmxnet3/vmxnet3_ethdev.c b/drivers/net/vmxnet3/vmxnet3_ethdev.c
index 467fb61137..8d7f95a753 100644
--- a/drivers/net/vmxnet3/vmxnet3_ethdev.c
+++ b/drivers/net/vmxnet3/vmxnet3_ethdev.c
@@ -403,6 +403,7 @@ eth_vmxnet3_dev_init(struct rte_eth_dev *eth_dev)
/* Vendor and Device ID need to be set before init of shared code */
hw->device_id = pci_dev->id.device_id;
hw->vendor_id = pci_dev->id.vendor_id;
+ hw->adapter_stopped = TRUE;
hw->hw_addr0 = (void *)pci_dev->mem_resource[0].addr;
hw->hw_addr1 = (void *)pci_dev->mem_resource[1].addr;
--
2.47.0
^ permalink raw reply [flat|nested] 6+ messages in thread
* RE: [PATCH] net/vmxnet3: Fix vmxnet3 NULL pointer deref after configuration failure
2024-10-26 14:33 [PATCH] net/vmxnet3: Fix vmxnet3 NULL pointer deref after configuration failure Roger B Melton
@ 2024-10-27 8:43 ` Morten Brørup
2024-10-31 5:38 ` Ferruh Yigit
2024-10-30 3:15 ` Ferruh Yigit
1 sibling, 1 reply; 6+ messages in thread
From: Morten Brørup @ 2024-10-27 8:43 UTC (permalink / raw)
To: Roger B Melton, Jochen Behrens; +Cc: dev, Ronak Doshi
> From: Roger B Melton [mailto:rmelton@cisco.com]
> Sent: Saturday, 26 October 2024 16.34
>
> Problem:
>
> If vxmnet3_dev_configure() fails, applications may call
> vmxnet3_dev_close(). If the failure occurs before the vmxnet3
> hw->shared structure is allocated the close will lead to a segv.
>
> Root Cause:
>
> This crash is due to incorrect adapter_stopped state in the
> vmxnet3 dev_private structure. When dev_private is allocated,
> adapter_stopped will be 0 (FALSE). eth_vmxnet3_dev_init() does not
> set it to TRUE, so it will remain FALSE until a successful
> vmxnet3_dev_start() followed by a vmxnet3_dev_stop(). When
> vmxnet3_dev_close() is called, it will invoke vmxnet3_dev_stop().
> vmxnet3_dev_stop() will check the adapter_stopped state in the
> vmxnet3 shared data, find it is FALSE and will proceed to stop the
> device, calling vmxnet3_disable_all_intrs().
> vmxnet3_disable_all_intrs() attempts to access the vmxnet3 shared data
> resulting in the segv.
>
> Solution:
>
> Set adapter_stopped to TRUE in eth_vmxnet3_dev_init(), to prevent stop
> processing.
>
> Signed-off-by: Roger B Melton <rmelton@cisco.com>
> ---
> drivers/net/vmxnet3/vmxnet3_ethdev.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/net/vmxnet3/vmxnet3_ethdev.c
> b/drivers/net/vmxnet3/vmxnet3_ethdev.c
> index 467fb61137..8d7f95a753 100644
> --- a/drivers/net/vmxnet3/vmxnet3_ethdev.c
> +++ b/drivers/net/vmxnet3/vmxnet3_ethdev.c
> @@ -403,6 +403,7 @@ eth_vmxnet3_dev_init(struct rte_eth_dev *eth_dev)
> /* Vendor and Device ID need to be set before init of shared code
> */
> hw->device_id = pci_dev->id.device_id;
> hw->vendor_id = pci_dev->id.vendor_id;
> + hw->adapter_stopped = TRUE;
> hw->hw_addr0 = (void *)pci_dev->mem_resource[0].addr;
> hw->hw_addr1 = (void *)pci_dev->mem_resource[1].addr;
>
> --
> 2.47.0
Acked-by: Morten Brørup <mb@smartsharesystems.com>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] net/vmxnet3: Fix vmxnet3 NULL pointer deref after configuration failure
2024-10-27 8:43 ` Morten Brørup
@ 2024-10-31 5:38 ` Ferruh Yigit
0 siblings, 0 replies; 6+ messages in thread
From: Ferruh Yigit @ 2024-10-31 5:38 UTC (permalink / raw)
To: Morten Brørup, Roger B Melton, Jochen Behrens; +Cc: dev, Ronak Doshi
On 10/27/2024 8:43 AM, Morten Brørup wrote:
>> From: Roger B Melton [mailto:rmelton@cisco.com]
>> Sent: Saturday, 26 October 2024 16.34
>>
>> Problem:
>>
>> If vxmnet3_dev_configure() fails, applications may call
>> vmxnet3_dev_close(). If the failure occurs before the vmxnet3
>> hw->shared structure is allocated the close will lead to a segv.
>>
>> Root Cause:
>>
>> This crash is due to incorrect adapter_stopped state in the
>> vmxnet3 dev_private structure. When dev_private is allocated,
>> adapter_stopped will be 0 (FALSE). eth_vmxnet3_dev_init() does not
>> set it to TRUE, so it will remain FALSE until a successful
>> vmxnet3_dev_start() followed by a vmxnet3_dev_stop(). When
>> vmxnet3_dev_close() is called, it will invoke vmxnet3_dev_stop().
>> vmxnet3_dev_stop() will check the adapter_stopped state in the
>> vmxnet3 shared data, find it is FALSE and will proceed to stop the
>> device, calling vmxnet3_disable_all_intrs().
>> vmxnet3_disable_all_intrs() attempts to access the vmxnet3 shared data
>> resulting in the segv.
>>
>> Solution:
>>
>> Set adapter_stopped to TRUE in eth_vmxnet3_dev_init(), to prevent stop
>> processing.
>>
>> Signed-off-by: Roger B Melton <rmelton@cisco.com>
>
> Acked-by: Morten Brørup <mb@smartsharesystems.com>
>
Fixes: dfaff37fc46d ("vmxnet3: import new vmxnet3 poll mode driver
implementation")
Cc: stable@dpdk.org
Applied to dpdk-next-net/main, thanks.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] net/vmxnet3: Fix vmxnet3 NULL pointer deref after configuration failure
2024-10-26 14:33 [PATCH] net/vmxnet3: Fix vmxnet3 NULL pointer deref after configuration failure Roger B Melton
2024-10-27 8:43 ` Morten Brørup
@ 2024-10-30 3:15 ` Ferruh Yigit
2024-10-30 20:27 ` Roger Melton (rmelton)
1 sibling, 1 reply; 6+ messages in thread
From: Ferruh Yigit @ 2024-10-30 3:15 UTC (permalink / raw)
To: Roger B Melton, Jochen Behrens; +Cc: dev
On 10/26/2024 3:33 PM, Roger B Melton wrote:
> Problem:
>
> If vxmnet3_dev_configure() fails, applications may call
> vmxnet3_dev_close(). If the failure occurs before the vmxnet3
> hw->shared structure is allocated the close will lead to a segv.
>
> Root Cause:
>
> This crash is due to incorrect adapter_stopped state in the
> vmxnet3 dev_private structure. When dev_private is allocated,
> adapter_stopped will be 0 (FALSE). eth_vmxnet3_dev_init() does not
> set it to TRUE, so it will remain FALSE until a successful
> vmxnet3_dev_start() followed by a vmxnet3_dev_stop(). When
> vmxnet3_dev_close() is called, it will invoke vmxnet3_dev_stop().
> vmxnet3_dev_stop() will check the adapter_stopped state in the
> vmxnet3 shared data, find it is FALSE and will proceed to stop the
> device, calling vmxnet3_disable_all_intrs().
> vmxnet3_disable_all_intrs() attempts to access the vmxnet3 shared data
> resulting in the segv.
>
> Solution:
>
> Set adapter_stopped to TRUE in eth_vmxnet3_dev_init(), to prevent stop
> processing.
>
> Signed-off-by: Roger B Melton <rmelton@cisco.com>
> ---
> drivers/net/vmxnet3/vmxnet3_ethdev.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/net/vmxnet3/vmxnet3_ethdev.c b/drivers/net/vmxnet3/vmxnet3_ethdev.c
> index 467fb61137..8d7f95a753 100644
> --- a/drivers/net/vmxnet3/vmxnet3_ethdev.c
> +++ b/drivers/net/vmxnet3/vmxnet3_ethdev.c
> @@ -403,6 +403,7 @@ eth_vmxnet3_dev_init(struct rte_eth_dev *eth_dev)
> /* Vendor and Device ID need to be set before init of shared code */
> hw->device_id = pci_dev->id.device_id;
> hw->vendor_id = pci_dev->id.vendor_id;
> + hw->adapter_stopped = TRUE;
> hw->hw_addr0 = (void *)pci_dev->mem_resource[0].addr;
> hw->hw_addr1 = (void *)pci_dev->mem_resource[1].addr;
>
Hi Roger,
Can you please provide fixes tag?
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] net/vmxnet3: Fix vmxnet3 NULL pointer deref after configuration failure
2024-10-30 3:15 ` Ferruh Yigit
@ 2024-10-30 20:27 ` Roger Melton (rmelton)
2024-10-31 0:08 ` Roger Melton (rmelton)
0 siblings, 1 reply; 6+ messages in thread
From: Roger Melton (rmelton) @ 2024-10-30 20:27 UTC (permalink / raw)
To: Ferruh Yigit, Jochen Behrens; +Cc: dev
On 10/29/24 11:15 PM, Ferruh Yigit wrote:
> On 10/26/2024 3:33 PM, Roger B Melton wrote:
>> Problem:
>>
>> If vxmnet3_dev_configure() fails, applications may call
>> vmxnet3_dev_close(). If the failure occurs before the vmxnet3
>> hw->shared structure is allocated the close will lead to a segv.
>>
>> Root Cause:
>>
>> This crash is due to incorrect adapter_stopped state in the
>> vmxnet3 dev_private structure. When dev_private is allocated,
>> adapter_stopped will be 0 (FALSE). eth_vmxnet3_dev_init() does not
>> set it to TRUE, so it will remain FALSE until a successful
>> vmxnet3_dev_start() followed by a vmxnet3_dev_stop(). When
>> vmxnet3_dev_close() is called, it will invoke vmxnet3_dev_stop().
>> vmxnet3_dev_stop() will check the adapter_stopped state in the
>> vmxnet3 shared data, find it is FALSE and will proceed to stop the
>> device, calling vmxnet3_disable_all_intrs().
>> vmxnet3_disable_all_intrs() attempts to access the vmxnet3 shared data
>> resulting in the segv.
>>
>> Solution:
>>
>> Set adapter_stopped to TRUE in eth_vmxnet3_dev_init(), to prevent stop
>> processing.
>>
>> Signed-off-by: Roger B Melton <rmelton@cisco.com>
>> ---
>> drivers/net/vmxnet3/vmxnet3_ethdev.c | 1 +
>> 1 file changed, 1 insertion(+)
>>
>> diff --git a/drivers/net/vmxnet3/vmxnet3_ethdev.c b/drivers/net/vmxnet3/vmxnet3_ethdev.c
>> index 467fb61137..8d7f95a753 100644
>> --- a/drivers/net/vmxnet3/vmxnet3_ethdev.c
>> +++ b/drivers/net/vmxnet3/vmxnet3_ethdev.c
>> @@ -403,6 +403,7 @@ eth_vmxnet3_dev_init(struct rte_eth_dev *eth_dev)
>> /* Vendor and Device ID need to be set before init of shared code */
>> hw->device_id = pci_dev->id.device_id;
>> hw->vendor_id = pci_dev->id.vendor_id;
>> + hw->adapter_stopped = TRUE;
>> hw->hw_addr0 = (void *)pci_dev->mem_resource[0].addr;
>> hw->hw_addr1 = (void *)pci_dev->mem_resource[1].addr;
>>
>
> Hi Roger,
>
> Can you please provide fixes tag?
>
Hi Ferruh,
I can do that.
Apologies for not including with the original submission. I didn't think
fixes tag was required since the bug is present in the first import of
vmxnet3 in v1.6.0r0. See below.
-Roger
commit dfaff37fc46d6ef1700c44f03f38bf7dd24347e4
Author: Bruce Richardson <bruce.richardson@intel.com>
Date: Mon Feb 10 15:27:26 2014 +0000
vmxnet3: import new vmxnet3 poll mode driver implementation
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH] net/vmxnet3: Fix vmxnet3 NULL pointer deref after configuration failure
2024-10-30 20:27 ` Roger Melton (rmelton)
@ 2024-10-31 0:08 ` Roger Melton (rmelton)
0 siblings, 0 replies; 6+ messages in thread
From: Roger Melton (rmelton) @ 2024-10-31 0:08 UTC (permalink / raw)
To: Ferruh Yigit, Jochen Behrens; +Cc: dev
On 10/30/24 4:28 PM, Roger Melton (rmelton) wrote:
> On 10/29/24 11:15 PM, Ferruh Yigit wrote:
>> On 10/26/2024 3:33 PM, Roger B Melton wrote:
>>> Problem:
>>>
>>> If vxmnet3_dev_configure() fails, applications may call
>>> vmxnet3_dev_close(). If the failure occurs before the vmxnet3
>>> hw->shared structure is allocated the close will lead to a segv.
>>>
>>> Root Cause:
>>>
>>> This crash is due to incorrect adapter_stopped state in the
>>> vmxnet3 dev_private structure. When dev_private is allocated,
>>> adapter_stopped will be 0 (FALSE). eth_vmxnet3_dev_init() does not
>>> set it to TRUE, so it will remain FALSE until a successful
>>> vmxnet3_dev_start() followed by a vmxnet3_dev_stop(). When
>>> vmxnet3_dev_close() is called, it will invoke vmxnet3_dev_stop().
>>> vmxnet3_dev_stop() will check the adapter_stopped state in the
>>> vmxnet3 shared data, find it is FALSE and will proceed to stop the
>>> device, calling vmxnet3_disable_all_intrs().
>>> vmxnet3_disable_all_intrs() attempts to access the vmxnet3 shared data
>>> resulting in the segv.
>>>
>>> Solution:
>>>
>>> Set adapter_stopped to TRUE in eth_vmxnet3_dev_init(), to prevent stop
>>> processing.
>>>
>>> Signed-off-by: Roger B Melton <rmelton@cisco.com>
>>> ---
>>> drivers/net/vmxnet3/vmxnet3_ethdev.c | 1 +
>>> 1 file changed, 1 insertion(+)
>>>
>>> diff --git a/drivers/net/vmxnet3/vmxnet3_ethdev.c b/drivers/net/vmxnet3/vmxnet3_ethdev.c
>>> index 467fb61137..8d7f95a753 100644
>>> --- a/drivers/net/vmxnet3/vmxnet3_ethdev.c
>>> +++ b/drivers/net/vmxnet3/vmxnet3_ethdev.c
>>> @@ -403,6 +403,7 @@ eth_vmxnet3_dev_init(struct rte_eth_dev *eth_dev)
>>> /* Vendor and Device ID need to be set before init of shared code */
>>> hw->device_id = pci_dev->id.device_id;
>>> hw->vendor_id = pci_dev->id.vendor_id;
>>> + hw->adapter_stopped = TRUE;
>>> hw->hw_addr0 = (void *)pci_dev->mem_resource[0].addr;
>>> hw->hw_addr1 = (void *)pci_dev->mem_resource[1].addr;
>>>
>>
>> Hi Roger,
>>
>> Can you please provide fixes tag?
>>
>
> Hi Ferruh,
>
> I can do that.
>
> Apologies for not including with the original submission. I didn't think
> fixes tag was required since the bug is present in the first import of
> vmxnet3 in v1.6.0r0. See below.
>
> -Roger
>
> commit dfaff37fc46d6ef1700c44f03f38bf7dd24347e4
> Author: Bruce Richardson <bruce.richardson@intel.com>
> Date: Mon Feb 10 15:27:26 2014 +0000
>
> vmxnet3: import new vmxnet3 poll mode driver implementation
>
>
Fixes: dfaff37fc4 ("vmxnet3: import new vmxnet3 poll mode driver implementation")
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2024-10-31 5:38 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2024-10-26 14:33 [PATCH] net/vmxnet3: Fix vmxnet3 NULL pointer deref after configuration failure Roger B Melton
2024-10-27 8:43 ` Morten Brørup
2024-10-31 5:38 ` Ferruh Yigit
2024-10-30 3:15 ` Ferruh Yigit
2024-10-30 20:27 ` Roger Melton (rmelton)
2024-10-31 0:08 ` Roger Melton (rmelton)
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).