Fix crash in via-velocity driver (rhbz 1022733)
This commit is contained in:
parent
afaeef6a87
commit
94ec42f007
|
@ -769,6 +769,9 @@ Patch25156: aacraid-prevent-invalid-pointer-dereference.patch
|
||||||
#CVE-2013-6382 rhbz 1033603 1034670
|
#CVE-2013-6382 rhbz 1033603 1034670
|
||||||
Patch25157: xfs-underflow-bug-in-xfs_attrlist_by_handle.patch
|
Patch25157: xfs-underflow-bug-in-xfs_attrlist_by_handle.patch
|
||||||
|
|
||||||
|
#rhbz 1022733
|
||||||
|
Patch25158: via-velocity-fix-netif_receive_skb-use-in-irq-disable.patch
|
||||||
|
|
||||||
# END OF PATCH DEFINITIONS
|
# END OF PATCH DEFINITIONS
|
||||||
|
|
||||||
%endif
|
%endif
|
||||||
|
@ -1506,6 +1509,9 @@ ApplyPatch aacraid-prevent-invalid-pointer-dereference.patch
|
||||||
#CVE-2013-6382 rhbz 1033603 1034670
|
#CVE-2013-6382 rhbz 1033603 1034670
|
||||||
ApplyPatch xfs-underflow-bug-in-xfs_attrlist_by_handle.patch
|
ApplyPatch xfs-underflow-bug-in-xfs_attrlist_by_handle.patch
|
||||||
|
|
||||||
|
#rhbz 1022733
|
||||||
|
ApplyPatch via-velocity-fix-netif_receive_skb-use-in-irq-disable.patch
|
||||||
|
|
||||||
# END OF PATCH APPLICATIONS
|
# END OF PATCH APPLICATIONS
|
||||||
|
|
||||||
%endif
|
%endif
|
||||||
|
@ -2310,6 +2316,7 @@ fi
|
||||||
# || ||
|
# || ||
|
||||||
%changelog
|
%changelog
|
||||||
* Tue Nov 26 2013 Josh Boyer <jwboyer@fedoraproject.org>
|
* Tue Nov 26 2013 Josh Boyer <jwboyer@fedoraproject.org>
|
||||||
|
- Fix crash in via-velocity driver (rhbz 1022733)
|
||||||
- CVE-2013-6382 xfs: missing check for ZERO_SIZE_PTR (rhbz 1033603 1034670)
|
- CVE-2013-6382 xfs: missing check for ZERO_SIZE_PTR (rhbz 1033603 1034670)
|
||||||
|
|
||||||
* Mon Nov 25 2013 Josh Boyer <jwboyer@fedoraproject.org>
|
* Mon Nov 25 2013 Josh Boyer <jwboyer@fedoraproject.org>
|
||||||
|
|
|
@ -0,0 +1,121 @@
|
||||||
|
Bugzilla: 1022733
|
||||||
|
Upstream: Submitted for 3.13 and 3.12.y stable
|
||||||
|
Delivered-To: jwboyer@gmail.com
|
||||||
|
Received: by 10.76.104.107 with SMTP id gd11csp116929oab;
|
||||||
|
Mon, 25 Nov 2013 15:45:36 -0800 (PST)
|
||||||
|
X-Received: by 10.68.254.105 with SMTP id ah9mr20726084pbd.87.1385423136297;
|
||||||
|
Mon, 25 Nov 2013 15:45:36 -0800 (PST)
|
||||||
|
Return-Path: <netdev-owner@vger.kernel.org>
|
||||||
|
Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67])
|
||||||
|
by mx.google.com with ESMTP id am2si28999873pad.96.2013.11.25.15.44.53
|
||||||
|
for <multiple recipients>;
|
||||||
|
Mon, 25 Nov 2013 15:45:36 -0800 (PST)
|
||||||
|
Received-SPF: pass (google.com: best guess record for domain of netdev-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
|
||||||
|
Authentication-Results: mx.google.com;
|
||||||
|
spf=pass (google.com: best guess record for domain of netdev-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mail=netdev-owner@vger.kernel.org
|
||||||
|
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
|
||||||
|
id S1753536Ab3KYXl6 (ORCPT <rfc822;lnxuff@gmail.com> + 99 others);
|
||||||
|
Mon, 25 Nov 2013 18:41:58 -0500
|
||||||
|
Received: from violet.fr.zoreil.com ([92.243.8.30]:57806 "EHLO
|
||||||
|
violet.fr.zoreil.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
|
||||||
|
with ESMTP id S1751913Ab3KYXlz (ORCPT
|
||||||
|
<rfc822;netdev@vger.kernel.org>); Mon, 25 Nov 2013 18:41:55 -0500
|
||||||
|
Received: from violet.fr.zoreil.com (localhost [127.0.0.1])
|
||||||
|
by violet.fr.zoreil.com (8.14.5/8.14.5) with ESMTP id rAPNewrt012676;
|
||||||
|
Tue, 26 Nov 2013 00:40:58 +0100
|
||||||
|
Received: (from romieu@localhost)
|
||||||
|
by violet.fr.zoreil.com (8.14.5/8.14.5/Submit) id rAPNewbX012675;
|
||||||
|
Tue, 26 Nov 2013 00:40:58 +0100
|
||||||
|
Date: Tue, 26 Nov 2013 00:40:58 +0100
|
||||||
|
From: Francois Romieu <romieu@fr.zoreil.com>
|
||||||
|
To: netdev@vger.kernel.org
|
||||||
|
Cc: David Miller <davem@davemloft.net>,
|
||||||
|
"Alex A. Schmidt" <aaschmidt1@gmail.com>,
|
||||||
|
Michele Baldessari <michele@acksyn.org>,
|
||||||
|
Jamie Heilman <jamie@audible.transient.net>,
|
||||||
|
Julia Lawall <Julia.Lawall@lip6.fr>
|
||||||
|
Subject: [PATCH net 1/1] via-velocity: fix netif_receive_skb use in irq
|
||||||
|
disabled section.
|
||||||
|
Message-ID: <20131125234058.GA12566@electric-eye.fr.zoreil.com>
|
||||||
|
MIME-Version: 1.0
|
||||||
|
Content-Type: text/plain; charset=us-ascii
|
||||||
|
Content-Disposition: inline
|
||||||
|
X-Organisation: Land of Sunshine Inc.
|
||||||
|
User-Agent: Mutt/1.5.21 (2010-09-15)
|
||||||
|
Sender: netdev-owner@vger.kernel.org
|
||||||
|
Precedence: bulk
|
||||||
|
List-ID: <netdev.vger.kernel.org>
|
||||||
|
X-Mailing-List: netdev@vger.kernel.org
|
||||||
|
|
||||||
|
2fdac010bdcf10a30711b6924612dfc40daf19b8 ("via-velocity.c: update napi
|
||||||
|
implementation") overlooked an irq disabling spinlock when the Rx part
|
||||||
|
of the NAPI poll handler was converted from netif_rx to netif_receive_skb.
|
||||||
|
|
||||||
|
NAPI Rx processing can be taken out of the locked section with a pair of
|
||||||
|
napi_{disable / enable} since it only races with the MTU change function.
|
||||||
|
|
||||||
|
An heavier rework of the NAPI locking would be able to perform NAPI Tx
|
||||||
|
before Rx where I simply removed one of velocity_tx_srv calls.
|
||||||
|
|
||||||
|
References: https://bugzilla.redhat.com/show_bug.cgi?id=1022733
|
||||||
|
Fixes: 2fdac010bdcf (via-velocity.c: update napi implementation)
|
||||||
|
Signed-off-by: Francois Romieu <romieu@fr.zoreil.com>
|
||||||
|
Tested-by: Alex A. Schmidt <aaschmidt1@gmail.com>
|
||||||
|
Cc: Jamie Heilman <jamie@audible.transient.net>
|
||||||
|
Cc: Michele Baldessari <michele@acksyn.org>
|
||||||
|
Cc: Julia Lawall <Julia.Lawall@lip6.fr>
|
||||||
|
---
|
||||||
|
|
||||||
|
It is relevant for stable 3.11.x and 3.12.y.
|
||||||
|
|
||||||
|
drivers/net/ethernet/via/via-velocity.c | 11 ++++++-----
|
||||||
|
1 file changed, 6 insertions(+), 5 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/drivers/net/ethernet/via/via-velocity.c b/drivers/net/ethernet/via/via-velocity.c
|
||||||
|
index d022bf9..ad61d26 100644
|
||||||
|
--- a/drivers/net/ethernet/via/via-velocity.c
|
||||||
|
+++ b/drivers/net/ethernet/via/via-velocity.c
|
||||||
|
@@ -2172,16 +2172,13 @@ static int velocity_poll(struct napi_struct *napi, int budget)
|
||||||
|
unsigned int rx_done;
|
||||||
|
unsigned long flags;
|
||||||
|
|
||||||
|
- spin_lock_irqsave(&vptr->lock, flags);
|
||||||
|
/*
|
||||||
|
* Do rx and tx twice for performance (taken from the VIA
|
||||||
|
* out-of-tree driver).
|
||||||
|
*/
|
||||||
|
- rx_done = velocity_rx_srv(vptr, budget / 2);
|
||||||
|
- velocity_tx_srv(vptr);
|
||||||
|
- rx_done += velocity_rx_srv(vptr, budget - rx_done);
|
||||||
|
+ rx_done = velocity_rx_srv(vptr, budget);
|
||||||
|
+ spin_lock_irqsave(&vptr->lock, flags);
|
||||||
|
velocity_tx_srv(vptr);
|
||||||
|
-
|
||||||
|
/* If budget not fully consumed, exit the polling mode */
|
||||||
|
if (rx_done < budget) {
|
||||||
|
napi_complete(napi);
|
||||||
|
@@ -2342,6 +2339,8 @@ static int velocity_change_mtu(struct net_device *dev, int new_mtu)
|
||||||
|
if (ret < 0)
|
||||||
|
goto out_free_tmp_vptr_1;
|
||||||
|
|
||||||
|
+ napi_disable(&vptr->napi);
|
||||||
|
+
|
||||||
|
spin_lock_irqsave(&vptr->lock, flags);
|
||||||
|
|
||||||
|
netif_stop_queue(dev);
|
||||||
|
@@ -2362,6 +2361,8 @@ static int velocity_change_mtu(struct net_device *dev, int new_mtu)
|
||||||
|
|
||||||
|
velocity_give_many_rx_descs(vptr);
|
||||||
|
|
||||||
|
+ napi_enable(&vptr->napi);
|
||||||
|
+
|
||||||
|
mac_enable_int(vptr->mac_regs);
|
||||||
|
netif_start_queue(dev);
|
||||||
|
|
||||||
|
--
|
||||||
|
1.8.3.1
|
||||||
|
|
||||||
|
--
|
||||||
|
To unsubscribe from this list: send the line "unsubscribe netdev" in
|
||||||
|
the body of a message to majordomo@vger.kernel.org
|
||||||
|
More majordomo info at http://vger.kernel.org/majordomo-info.html
|
Loading…
Reference in New Issue