• Krister Johansen's avatar
    net: ena: fix shift-out-of-bounds in exponential backoff · 1e9cb763
    Krister Johansen authored
    The ENA adapters on our instances occasionally reset.  Once recently
    logged a UBSAN failure to console in the process:
    
      UBSAN: shift-out-of-bounds in build/linux/drivers/net/ethernet/amazon/ena/ena_com.c:540:13
      shift exponent 32 is too large for 32-bit type 'unsigned int'
      CPU: 28 PID: 70012 Comm: kworker/u72:2 Kdump: loaded not tainted 5.15.117
      Hardware name: Amazon EC2 c5d.9xlarge/, BIOS 1.0 10/16/2017
      Workqueue: ena ena_fw_reset_device [ena]
      Call Trace:
      <TASK>
      dump_stack_lvl+0x4a/0x63
      dump_stack+0x10/0x16
      ubsan_epilogue+0x9/0x36
      __ubsan_handle_shift_out_of_bounds.cold+0x61/0x10e
      ? __const_udelay+0x43/0x50
      ena_delay_exponential_backoff_us.cold+0x16/0x1e [ena]
      wait_for_reset_state+0x54/0xa0 [ena]
      ena_com_dev_reset+0xc8/0x110 [ena]
      ena_down+0x3fe/0x480 [ena]
      ena_destroy_device+0xeb/0xf0 [ena]
      ena_fw_reset_device+0x30/0x50 [ena]
      process_one_work+0x22b/0x3d0
      worker_thread+0x4d/0x3f0
      ? process_one_work+0x3d0/0x3d0
      kthread+0x12a/0x150
      ? set_kthread_struct+0x50/0x50
      ret_from_fork+0x22/0x30
      </TASK>
    
    Apparently, the reset delays are getting so large they can trigger a
    UBSAN panic.
    
    Looking at the code, the current timeout is capped at 5000us.  Using a
    base value of 100us, the current code will overflow after (1<<29).  Even
    at values before 32, this function wraps around, perhaps
    unintentionally.
    
    Cap the value of the exponent used for this backoff at (1<<16) which is
    larger than currently necessary, but large enough to support bigger
    values in the future.
    
    Cc: stable@vger.kernel.org
    Fixes: 4bb7f4cf ("net: ena: reduce driver load time")
    Signed-off-by: default avatarKrister Johansen <kjlx@templeofstupid.com>
    Reviewed-by: default avatarLeon Romanovsky <leonro@nvidia.com>
    Reviewed-by: default avatarShay Agroskin <shayagr@amazon.com>
    Link: https://lore.kernel.org/r/20230711013621.GE1926@templeofstupid.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
    1e9cb763
ena_com.c 83.9 KB