Fix crash in via-velocity driver (rhbz 1022733)
This commit is contained in:
Josh Boyer
parent
afaeef6a87
commit
94ec42f007
|
|
@ -769,6 +769,9 @@ Patch25156: aacraid-prevent-invalid-pointer-dereference.patch
|
|||
#CVE-2013-6382 rhbz 1033603 1034670
|
||||
Patch25157: xfs-underflow-bug-in-xfs_attrlist_by_handle.patch
|
||||
|
||||
#rhbz 1022733
|
||||
Patch25158: via-velocity-fix-netif_receive_skb-use-in-irq-disable.patch
|
||||
|
||||
# END OF PATCH DEFINITIONS
|
||||
|
||||
%endif
|
||||
|
|
@ -1506,6 +1509,9 @@ ApplyPatch aacraid-prevent-invalid-pointer-dereference.patch
|
|||
#CVE-2013-6382 rhbz 1033603 1034670
|
||||
ApplyPatch xfs-underflow-bug-in-xfs_attrlist_by_handle.patch
|
||||
|
||||
#rhbz 1022733
|
||||
ApplyPatch via-velocity-fix-netif_receive_skb-use-in-irq-disable.patch
|
||||
|
||||
# END OF PATCH APPLICATIONS
|
||||
|
||||
%endif
|
||||
|
|
@ -2310,6 +2316,7 @@ fi
|
|||
# || ||
|
||||
%changelog
|
||||
* Tue Nov 26 2013 Josh Boyer <jwboyer@fedoraproject.org>
|
||||
- Fix crash in via-velocity driver (rhbz 1022733)
|
||||
- CVE-2013-6382 xfs: missing check for ZERO_SIZE_PTR (rhbz 1033603 1034670)
|
||||
|
||||
* Mon Nov 25 2013 Josh Boyer <jwboyer@fedoraproject.org>
|
||||
|
|
|
|||
|
|
@ -0,0 +1,121 @@
|
|||
Bugzilla: 1022733
|
||||
Upstream: Submitted for 3.13 and 3.12.y stable
|
||||
Delivered-To: jwboyer@gmail.com
|
||||
Received: by 10.76.104.107 with SMTP id gd11csp116929oab;
|
||||
Mon, 25 Nov 2013 15:45:36 -0800 (PST)
|
||||
X-Received: by 10.68.254.105 with SMTP id ah9mr20726084pbd.87.1385423136297;
|
||||
Mon, 25 Nov 2013 15:45:36 -0800 (PST)
|
||||
Return-Path: <netdev-owner@vger.kernel.org>
|
||||
Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67])
|
||||
by mx.google.com with ESMTP id am2si28999873pad.96.2013.11.25.15.44.53
|
||||
for <multiple recipients>;
|
||||
Mon, 25 Nov 2013 15:45:36 -0800 (PST)
|
||||
Received-SPF: pass (google.com: best guess record for domain of netdev-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
|
||||
Authentication-Results: mx.google.com;
|
||||
spf=pass (google.com: best guess record for domain of netdev-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mail=netdev-owner@vger.kernel.org
|
||||
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
|
||||
id S1753536Ab3KYXl6 (ORCPT <rfc822;lnxuff@gmail.com> + 99 others);
|
||||
Mon, 25 Nov 2013 18:41:58 -0500
|
||||
Received: from violet.fr.zoreil.com ([92.243.8.30]:57806 "EHLO
|
||||
violet.fr.zoreil.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
|
||||
with ESMTP id S1751913Ab3KYXlz (ORCPT
|
||||
<rfc822;netdev@vger.kernel.org>); Mon, 25 Nov 2013 18:41:55 -0500
|
||||
Received: from violet.fr.zoreil.com (localhost [127.0.0.1])
|
||||
by violet.fr.zoreil.com (8.14.5/8.14.5) with ESMTP id rAPNewrt012676;
|
||||
Tue, 26 Nov 2013 00:40:58 +0100
|
||||
Received: (from romieu@localhost)
|
||||
by violet.fr.zoreil.com (8.14.5/8.14.5/Submit) id rAPNewbX012675;
|
||||
Tue, 26 Nov 2013 00:40:58 +0100
|
||||
Date: Tue, 26 Nov 2013 00:40:58 +0100
|
||||
From: Francois Romieu <romieu@fr.zoreil.com>
|
||||
To: netdev@vger.kernel.org
|
||||
Cc: David Miller <davem@davemloft.net>,
|
||||
"Alex A. Schmidt" <aaschmidt1@gmail.com>,
|
||||
Michele Baldessari <michele@acksyn.org>,
|
||||
Jamie Heilman <jamie@audible.transient.net>,
|
||||
Julia Lawall <Julia.Lawall@lip6.fr>
|
||||
Subject: [PATCH net 1/1] via-velocity: fix netif_receive_skb use in irq
|
||||
disabled section.
|
||||
Message-ID: <20131125234058.GA12566@electric-eye.fr.zoreil.com>
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=us-ascii
|
||||
Content-Disposition: inline
|
||||
X-Organisation: Land of Sunshine Inc.
|
||||
User-Agent: Mutt/1.5.21 (2010-09-15)
|
||||
Sender: netdev-owner@vger.kernel.org
|
||||
Precedence: bulk
|
||||
List-ID: <netdev.vger.kernel.org>
|
||||
X-Mailing-List: netdev@vger.kernel.org
|
||||
|
||||
2fdac010bdcf10a30711b6924612dfc40daf19b8 ("via-velocity.c: update napi
|
||||
implementation") overlooked an irq disabling spinlock when the Rx part
|
||||
of the NAPI poll handler was converted from netif_rx to netif_receive_skb.
|
||||
|
||||
NAPI Rx processing can be taken out of the locked section with a pair of
|
||||
napi_{disable / enable} since it only races with the MTU change function.
|
||||
|
||||
An heavier rework of the NAPI locking would be able to perform NAPI Tx
|
||||
before Rx where I simply removed one of velocity_tx_srv calls.
|
||||
|
||||
References: https://bugzilla.redhat.com/show_bug.cgi?id=1022733
|
||||
Fixes: 2fdac010bdcf (via-velocity.c: update napi implementation)
|
||||
Signed-off-by: Francois Romieu <romieu@fr.zoreil.com>
|
||||
Tested-by: Alex A. Schmidt <aaschmidt1@gmail.com>
|
||||
Cc: Jamie Heilman <jamie@audible.transient.net>
|
||||
Cc: Michele Baldessari <michele@acksyn.org>
|
||||
Cc: Julia Lawall <Julia.Lawall@lip6.fr>
|
||||
---
|
||||
|
||||
It is relevant for stable 3.11.x and 3.12.y.
|
||||
|
||||
drivers/net/ethernet/via/via-velocity.c | 11 ++++++-----
|
||||
1 file changed, 6 insertions(+), 5 deletions(-)
|
||||
|
||||
diff --git a/drivers/net/ethernet/via/via-velocity.c b/drivers/net/ethernet/via/via-velocity.c
|
||||
index d022bf9..ad61d26 100644
|
||||
--- a/drivers/net/ethernet/via/via-velocity.c
|
||||
+++ b/drivers/net/ethernet/via/via-velocity.c
|
||||
@@ -2172,16 +2172,13 @@ static int velocity_poll(struct napi_struct *napi, int budget)
|
||||
unsigned int rx_done;
|
||||
unsigned long flags;
|
||||
|
||||
- spin_lock_irqsave(&vptr->lock, flags);
|
||||
/*
|
||||
* Do rx and tx twice for performance (taken from the VIA
|
||||
* out-of-tree driver).
|
||||
*/
|
||||
- rx_done = velocity_rx_srv(vptr, budget / 2);
|
||||
- velocity_tx_srv(vptr);
|
||||
- rx_done += velocity_rx_srv(vptr, budget - rx_done);
|
||||
+ rx_done = velocity_rx_srv(vptr, budget);
|
||||
+ spin_lock_irqsave(&vptr->lock, flags);
|
||||
velocity_tx_srv(vptr);
|
||||
-
|
||||
/* If budget not fully consumed, exit the polling mode */
|
||||
if (rx_done < budget) {
|
||||
napi_complete(napi);
|
||||
@@ -2342,6 +2339,8 @@ static int velocity_change_mtu(struct net_device *dev, int new_mtu)
|
||||
if (ret < 0)
|
||||
goto out_free_tmp_vptr_1;
|
||||
|
||||
+ napi_disable(&vptr->napi);
|
||||
+
|
||||
spin_lock_irqsave(&vptr->lock, flags);
|
||||
|
||||
netif_stop_queue(dev);
|
||||
@@ -2362,6 +2361,8 @@ static int velocity_change_mtu(struct net_device *dev, int new_mtu)
|
||||
|
||||
velocity_give_many_rx_descs(vptr);
|
||||
|
||||
+ napi_enable(&vptr->napi);
|
||||
+
|
||||
mac_enable_int(vptr->mac_regs);
|
||||
netif_start_queue(dev);
|
||||
|
||||
--
|
||||
1.8.3.1
|
||||
|
||||
--
|
||||
To unsubscribe from this list: send the line "unsubscribe netdev" in
|
||||
the body of a message to majordomo@vger.kernel.org
|
||||
More majordomo info at http://vger.kernel.org/majordomo-info.html
|
||||
Loading…
Reference in New Issue