[kernel/f19] Fix crash in via-velocity driver (rhbz 1022733)
Josh Boyer
jwboyer at fedoraproject.org
Tue Nov 26 19:00:00 UTC 2013
commit 3b424ab866aa6f872157d8db11433db9dcac6d35
Author: Josh Boyer <jwboyer at fedoraproject.org>
Date: Tue Nov 26 13:59:14 2013 -0500
Fix crash in via-velocity driver (rhbz 1022733)
kernel.spec | 7 +
...-fix-netif_receive_skb-use-in-irq-disable.patch | 121 ++++++++++++++++++++
2 files changed, 128 insertions(+), 0 deletions(-)
---
diff --git a/kernel.spec b/kernel.spec
index ff91733..4a0db1f 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -814,6 +814,9 @@ Patch25156: aacraid-prevent-invalid-pointer-dereference.patch
#CVE-2013-6382 rhbz 1033603 1034670
Patch25157: xfs-underflow-bug-in-xfs_attrlist_by_handle.patch
+#rhbz 1022733
+Patch25158: via-velocity-fix-netif_receive_skb-use-in-irq-disable.patch
+
# END OF PATCH DEFINITIONS
%endif
@@ -1576,6 +1579,9 @@ ApplyPatch aacraid-prevent-invalid-pointer-dereference.patch
#CVE-2013-6382 rhbz 1033603 1034670
ApplyPatch xfs-underflow-bug-in-xfs_attrlist_by_handle.patch
+#rhbz 1022733
+ApplyPatch via-velocity-fix-netif_receive_skb-use-in-irq-disable.patch
+
# END OF PATCH APPLICATIONS
%endif
@@ -2389,6 +2395,7 @@ fi
%changelog
* Tue Nov 26 2013 Josh Boyer <jwboyer at fedoraproject.org>
+- Fix crash in via-velocity driver (rhbz 1022733)
- CVE-2013-6382 xfs: missing check for ZERO_SIZE_PTR (rhbz 1033603 1034670)
* Mon Nov 25 2013 Josh Boyer <jwboyer at fedoraproject.org>
diff --git a/via-velocity-fix-netif_receive_skb-use-in-irq-disable.patch b/via-velocity-fix-netif_receive_skb-use-in-irq-disable.patch
new file mode 100644
index 0000000..820f470
--- /dev/null
+++ b/via-velocity-fix-netif_receive_skb-use-in-irq-disable.patch
@@ -0,0 +1,121 @@
+Bugzilla: 1022733
+Upstream: Submitted for 3.13 and 3.12.y stable
+Delivered-To: jwboyer at gmail.com
+Received: by 10.76.104.107 with SMTP id gd11csp116929oab;
+ Mon, 25 Nov 2013 15:45:36 -0800 (PST)
+X-Received: by 10.68.254.105 with SMTP id ah9mr20726084pbd.87.1385423136297;
+ Mon, 25 Nov 2013 15:45:36 -0800 (PST)
+Return-Path: <netdev-owner at vger.kernel.org>
+Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67])
+ by mx.google.com with ESMTP id am2si28999873pad.96.2013.11.25.15.44.53
+ for <multiple recipients>;
+ Mon, 25 Nov 2013 15:45:36 -0800 (PST)
+Received-SPF: pass (google.com: best guess record for domain of netdev-owner at vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
+Authentication-Results: mx.google.com;
+ spf=pass (google.com: best guess record for domain of netdev-owner at vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mail=netdev-owner at vger.kernel.org
+Received: (majordomo at vger.kernel.org) by vger.kernel.org via listexpand
+ id S1753536Ab3KYXl6 (ORCPT <rfc822;lnxuff at gmail.com> + 99 others);
+ Mon, 25 Nov 2013 18:41:58 -0500
+Received: from violet.fr.zoreil.com ([92.243.8.30]:57806 "EHLO
+ violet.fr.zoreil.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
+ with ESMTP id S1751913Ab3KYXlz (ORCPT
+ <rfc822;netdev at vger.kernel.org>); Mon, 25 Nov 2013 18:41:55 -0500
+Received: from violet.fr.zoreil.com (localhost [127.0.0.1])
+ by violet.fr.zoreil.com (8.14.5/8.14.5) with ESMTP id rAPNewrt012676;
+ Tue, 26 Nov 2013 00:40:58 +0100
+Received: (from romieu at localhost)
+ by violet.fr.zoreil.com (8.14.5/8.14.5/Submit) id rAPNewbX012675;
+ Tue, 26 Nov 2013 00:40:58 +0100
+Date: Tue, 26 Nov 2013 00:40:58 +0100
+From: Francois Romieu <romieu at fr.zoreil.com>
+To: netdev at vger.kernel.org
+Cc: David Miller <davem at davemloft.net>,
+ "Alex A. Schmidt" <aaschmidt1 at gmail.com>,
+ Michele Baldessari <michele at acksyn.org>,
+ Jamie Heilman <jamie at audible.transient.net>,
+ Julia Lawall <Julia.Lawall at lip6.fr>
+Subject: [PATCH net 1/1] via-velocity: fix netif_receive_skb use in irq
+ disabled section.
+Message-ID: <20131125234058.GA12566 at electric-eye.fr.zoreil.com>
+MIME-Version: 1.0
+Content-Type: text/plain; charset=us-ascii
+Content-Disposition: inline
+X-Organisation: Land of Sunshine Inc.
+User-Agent: Mutt/1.5.21 (2010-09-15)
+Sender: netdev-owner at vger.kernel.org
+Precedence: bulk
+List-ID: <netdev.vger.kernel.org>
+X-Mailing-List: netdev at vger.kernel.org
+
+2fdac010bdcf10a30711b6924612dfc40daf19b8 ("via-velocity.c: update napi
+implementation") overlooked an irq disabling spinlock when the Rx part
+of the NAPI poll handler was converted from netif_rx to netif_receive_skb.
+
+NAPI Rx processing can be taken out of the locked section with a pair of
+napi_{disable / enable} since it only races with the MTU change function.
+
+An heavier rework of the NAPI locking would be able to perform NAPI Tx
+before Rx where I simply removed one of velocity_tx_srv calls.
+
+References: https://bugzilla.redhat.com/show_bug.cgi?id=1022733
+Fixes: 2fdac010bdcf (via-velocity.c: update napi implementation)
+Signed-off-by: Francois Romieu <romieu at fr.zoreil.com>
+Tested-by: Alex A. Schmidt <aaschmidt1 at gmail.com>
+Cc: Jamie Heilman <jamie at audible.transient.net>
+Cc: Michele Baldessari <michele at acksyn.org>
+Cc: Julia Lawall <Julia.Lawall at lip6.fr>
+---
+
+ It is relevant for stable 3.11.x and 3.12.y.
+
+ drivers/net/ethernet/via/via-velocity.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/ethernet/via/via-velocity.c b/drivers/net/ethernet/via/via-velocity.c
+index d022bf9..ad61d26 100644
+--- a/drivers/net/ethernet/via/via-velocity.c
++++ b/drivers/net/ethernet/via/via-velocity.c
+@@ -2172,16 +2172,13 @@ static int velocity_poll(struct napi_struct *napi, int budget)
+ unsigned int rx_done;
+ unsigned long flags;
+
+- spin_lock_irqsave(&vptr->lock, flags);
+ /*
+ * Do rx and tx twice for performance (taken from the VIA
+ * out-of-tree driver).
+ */
+- rx_done = velocity_rx_srv(vptr, budget / 2);
+- velocity_tx_srv(vptr);
+- rx_done += velocity_rx_srv(vptr, budget - rx_done);
++ rx_done = velocity_rx_srv(vptr, budget);
++ spin_lock_irqsave(&vptr->lock, flags);
+ velocity_tx_srv(vptr);
+-
+ /* If budget not fully consumed, exit the polling mode */
+ if (rx_done < budget) {
+ napi_complete(napi);
+@@ -2342,6 +2339,8 @@ static int velocity_change_mtu(struct net_device *dev, int new_mtu)
+ if (ret < 0)
+ goto out_free_tmp_vptr_1;
+
++ napi_disable(&vptr->napi);
++
+ spin_lock_irqsave(&vptr->lock, flags);
+
+ netif_stop_queue(dev);
+@@ -2362,6 +2361,8 @@ static int velocity_change_mtu(struct net_device *dev, int new_mtu)
+
+ velocity_give_many_rx_descs(vptr);
+
++ napi_enable(&vptr->napi);
++
+ mac_enable_int(vptr->mac_regs);
+ netif_start_queue(dev);
+
+--
+1.8.3.1
+
+--
+To unsubscribe from this list: send the line "unsubscribe netdev" in
+the body of a message to majordomo at vger.kernel.org
+More majordomo info at http://vger.kernel.org/majordomo-info.html
More information about the scm-commits
mailing list