kernel.git/drivers/net/ethernet/intel/igbvf, branch linux-4.4.y

igbvf: fix double free in `igbvf_probe`

2021-12-22T08:04:18Z

[ Upstream commit b6d335a60dc624c0d279333b22c737faa765b028 ] In `igbvf_probe`, if register_netdev() fails, the program will go to label err_hw_init, and then to label err_ioremap. In free_netdev() which is just below label err_ioremap, there is `list_for_each_entry_safe` and `netif_napi_del` which aims to delete all entries in `dev->napi_list`. The program has added an entry `adapter->rx_ring->napi` which is added by `netif_napi_add` in igbvf_alloc_queues(). However, adapter->rx_ring has been freed below label err_hw_init. So this a UAF. In terms of how to patch the problem, we can refer to igbvf_remove() and delete the entry before `adapter->rx_ring`. The KASAN logs are as follows: [ 35.126075] BUG: KASAN: use-after-free in free_netdev+0x1fd/0x450 [ 35.127170] Read of size 8 at addr ffff88810126d990 by task modprobe/366 [ 35.128360] [ 35.128643] CPU: 1 PID: 366 Comm: modprobe Not tainted 5.15.0-rc2+ #14 [ 35.129789] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 [ 35.131749] Call Trace: [ 35.132199] dump_stack_lvl+0x59/0x7b [ 35.132865] print_address_description+0x7c/0x3b0 [ 35.133707] ? free_netdev+0x1fd/0x450 [ 35.134378] __kasan_report+0x160/0x1c0 [ 35.135063] ? free_netdev+0x1fd/0x450 [ 35.135738] kasan_report+0x4b/0x70 [ 35.136367] free_netdev+0x1fd/0x450 [ 35.137006] igbvf_probe+0x121d/0x1a10 [igbvf] [ 35.137808] ? igbvf_vlan_rx_add_vid+0x100/0x100 [igbvf] [ 35.138751] local_pci_probe+0x13c/0x1f0 [ 35.139461] pci_device_probe+0x37e/0x6c0 [ 35.165526] [ 35.165806] Allocated by task 366: [ 35.166414] ____kasan_kmalloc+0xc4/0xf0 [ 35.167117] foo_kmem_cache_alloc_trace+0x3c/0x50 [igbvf] [ 35.168078] igbvf_probe+0x9c5/0x1a10 [igbvf] [ 35.168866] local_pci_probe+0x13c/0x1f0 [ 35.169565] pci_device_probe+0x37e/0x6c0 [ 35.179713] [ 35.179993] Freed by task 366: [ 35.180539] kasan_set_track+0x4c/0x80 [ 35.181211] kasan_set_free_info+0x1f/0x40 [ 35.181942] ____kasan_slab_free+0x103/0x140 [ 35.182703] kfree+0xe3/0x250 [ 35.183239] igbvf_probe+0x1173/0x1a10 [igbvf] [ 35.184040] local_pci_probe+0x13c/0x1f0 Fixes: d4e0fe01a38a0 (igbvf: add new driver to support 82576 virtual functions) Reported-by: Zheyu Ma Signed-off-by: Letu Ren Tested-by: Konrad Jankowski Signed-off-by: Tony Nguyen Signed-off-by: Sasha Levin

igbvf: Use smp_rmb rather than read_barrier_depends

2017-11-30T08:37:24Z

commit 1e1f9ca546556e508d021545861f6b5fc75a95fe upstream. The original issue being fixed in this patch was seen with the ixgbe driver, but the same issue exists with igbvf as well, as the code is very similar. read_barrier_depends is not sufficient to ensure loads following it are not speculatively loaded out of order by the CPU, which can result in stale data being loaded, causing potential system crashes. Signed-off-by: Brian King Acked-by: Jesse Brandeburg Tested-by: Aaron Brown Signed-off-by: Jeff Kirsher Signed-off-by: Greg Kroah-Hartman

drivers/net/intel: use napi_complete_done()

2015-10-16T11:33:46Z

As per Eric Dumazet's previous patches: (see commit (24d2e4a50737) - tg3: use napi_complete_done()) Quoting verbatim: Using napi_complete_done() instead of napi_complete() allows us to use /sys/class/net/ethX/gro_flush_timeout GRO layer can aggregate more packets if the flush is delayed a bit, without having to set too big coalescing parameters that impact latencies. Tested configuration: low latency via ethtool -C ethx adaptive-rx off rx-usecs 10 adaptive-tx off tx-usecs 15 workload: streaming rx using netperf TCP_MAERTS igb: MIGRATED TCP MAERTS TEST from 0.0.0.0 (0.0.0.0) port 0 AF_INET to 10.0.0.1 () port 0 AF_INET : demo ... Interim result: 941.48 10^6bits/s over 1.000 seconds ending at 1440193171.589 Alignment Offset Bytes Bytes Recvs Bytes Sends Local Remote Local Remote Xfered Per Per Recv Send Recv Send Recv (avg) Send (avg) 8 8 0 0 1176930056 1475.36 797726 16384.00 71905 MIGRATED TCP MAERTS TEST from 0.0.0.0 (0.0.0.0) port 0 AF_INET to 10.0.0.1 () port 0 AF_INET : demo ... Interim result: 941.49 10^6bits/s over 0.997 seconds ending at 1440193142.763 Alignment Offset Bytes Bytes Recvs Bytes Sends Local Remote Local Remote Xfered Per Per Recv Send Recv Send Recv (avg) Send (avg) 8 8 0 0 1175182320 50476.00 23282 16384.00 71816 i40e: Hard to test because the traffic is incoming so fast (24Gb/s) that GRO always receives 87kB, even at the highest interrupt rate. Other drivers were only compile tested. Signed-off-by: Jesse Brandeburg Tested-by: Andrew Bowers Signed-off-by: Jeff Kirsher

drivers/net: get rid of unnecessary initializations in .get_drvinfo()

2015-10-16T07:24:10Z

Many drivers initialize uselessly n_priv_flags, n_stats, testinfo_len, eedump_len & regdump_len fields in their .get_drvinfo() ethtool op. It's not necessary as these fields is filled in ethtool_get_drvinfo(). v2: removed unused variable v3: removed another unused variable Signed-off-by: Ivan Vecera Signed-off-by: David S. Miller

igbvf: Enable TSO for stacked VLAN

2015-09-22T22:58:28Z

Setting ndo_features_check to passthru_features_check allows the driver to skip the check for multiple tagged TSO packets and enables stacked VLAN TSO. Tested with I350. Signed-off-by: Toshiaki Makita Tested-by: Aaron Brown Signed-off-by: Jeff Kirsher

igbvf: clear buffer_info->dma after dma_unmap_single()

2015-08-18T21:06:06Z

The driver doesn't clear buffer_info->dma after calling dma_unmap_single() in all cases. This has been discovered by changing the mtu twice, which caused the following backtrace. [ 68.569280] WARNING: CPU: 2 PID: 1860 at drivers/iommu/intel-iommu.c:3517 intel_unmap+0x20c/0x220() [ 68.579392] Driver unmaps unmatched page at PFN fffc2a40 [ 68.585322] Modules linked in: igbvf ipt_MASQUERADE nf_nat_masquerade_ipv4 iptable_nat nf_nat_ipv4 nf_nat kvm_intel kvm igb megs [ 68.599163] CPU: 2 PID: 1860 Comm: ifconfig Not tainted 4.2.0-rc4+ #147 [ 68.606543] Hardware name: IBM -[546025Z]-/00Y7630, BIOS -[VVE134TUS-1.51]- 10/17/2013 [ 68.615473] 0000000000000dbd ffff88046441bb08 ffffffff81a5ad0b ffffffff81e2f9ea [ 68.623775] ffff88046441bb58 ffff88046441bb48 ffffffff81056b55 ffff88047fc583c0 [ 68.632075] 0000000000000000 ffff880469a8e600 00000000fffc2a40 ffff880465b32098 [ 68.640375] Call Trace: [ 68.643109] [] dump_stack+0x48/0x5d [ 68.648844] [] warn_slowpath_common+0x95/0xe0 [ 68.655549] [] warn_slowpath_fmt+0x46/0x70 [ 68.661960] [] ? find_iova+0x54/0x90 [ 68.667791] [] intel_unmap+0x20c/0x220 [ 68.673815] [] intel_unmap_page+0xe/0x10 [ 68.680038] [] igbvf_clean_rx_ring+0x96/0x370 [igbvf] [ 68.687516] [] igbvf_down+0x105/0x110 [igbvf] [ 68.694219] [] igbvf_change_mtu+0x16b/0x180 [igbvf] [...] Signed-off-by: Stefan Assmann Acked-by: Jesse Brandeburg Tested-by: Aaron Brown Signed-off-by: Jeff Kirsher

igbvf: use netif_carrier_off earlier when bringing if down

2015-03-21T00:45:12Z

Use netif_carrier_off() first, since that will prevent the stack from queuing more packets to this IF. This operation is fast, and should behave much nicer when trying to bring down an interface under load. Reported-by: Eliezer Tamir Signed-off-by: Todd Fujinaka Signed-off-by: Jeff Kirsher

igbvf: cleanup msleep() and min/max() usage

2015-02-24T01:11:54Z

Fixed a few cases of when we used msleep() when we should have been using usleep_range(). Also updated the usage of min/max() to use min_t/max_t(). Signed-off-by: Jeff Kirsher Tested-by: Aaron Brown

igbvf: Fix code comments and whitespace

2015-02-24T01:11:54Z

Fix the code comments to align with the drivers/net/ commenting style. Also fix other checkpatch errors such as using tabs where possible and properly wrap lines to conform to the 80 char limit (unless it is a string). Signed-off-by: Jeff Kirsher Tested-by: Aaron Brown

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2015-02-05T22:33:28Z

Conflicts: drivers/net/vxlan.c drivers/vhost/net.c include/linux/if_vlan.h net/core/dev.c The net/core/dev.c conflict was the overlap of one commit marking an existing function static whilst another was adding a new function. In the include/linux/if_vlan.h case, the type used for a local variable was changed in 'net', whereas the function got rewritten to fix a stacked vlan bug in 'net-next'. In drivers/vhost/net.c, Al Viro's iov_iter conversions in 'net-next' overlapped with an endainness fix for VHOST 1.0 in 'net'. In drivers/net/vxlan.c, vxlan_find_vni() added a 'flags' parameter in 'net-next' whereas in 'net' there was a bug fix to pass in the correct network namespace pointer in calls to this function. Signed-off-by: David S. Miller