Commit a80bb8e7 authored by Ding Hui's avatar Ding Hui Committed by David S. Miller

sfc: Fix use-after-free due to selftest_work

There is a use-after-free scenario that is:

When the NIC is down, user set mac address or vlan tag to VF,
the xxx_set_vf_mac() or xxx_set_vf_vlan() will invoke efx_net_stop()
and efx_net_open(), since netif_running() is false, the port will not
start and keep port_enabled false, but selftest_work is scheduled
in efx_net_open().

If we remove the device before selftest_work run, the efx_stop_port()
will not be called since the NIC is down, and then efx is freed,
we will soon get a UAF in run_timer_softirq() like this:

[ 1178.907941] ==================================================================
[ 1178.907948] BUG: KASAN: use-after-free in run_timer_softirq+0xdea/0xe90
[ 1178.907950] Write of size 8 at addr ff11001f449cdc80 by task swapper/47/0
[ 1178.907950]
[ 1178.907953] CPU: 47 PID: 0 Comm: swapper/47 Kdump: loaded Tainted: G           O     --------- -t - 4.18.0 #1
[ 1178.907954] Hardware name: SANGFOR X620G40/WI2HG-208T1061A, BIOS SPYH051032-U01 04/01/2022
[ 1178.907955] Call Trace:
[ 1178.907956]  <IRQ>
[ 1178.907960]  dump_stack+0x71/0xab
[ 1178.907963]  print_address_description+0x6b/0x290
[ 1178.907965]  ? run_timer_softirq+0xdea/0xe90
[ 1178.907967]  kasan_report+0x14a/0x2b0
[ 1178.907968]  run_timer_softirq+0xdea/0xe90
[ 1178.907971]  ? init_timer_key+0x170/0x170
[ 1178.907973]  ? hrtimer_cancel+0x20/0x20
[ 1178.907976]  ? sched_clock+0x5/0x10
[ 1178.907978]  ? sched_clock_cpu+0x18/0x170
[ 1178.907981]  __do_softirq+0x1c8/0x5fa
[ 1178.907985]  irq_exit+0x213/0x240
[ 1178.907987]  smp_apic_timer_interrupt+0xd0/0x330
[ 1178.907989]  apic_timer_interrupt+0xf/0x20
[ 1178.907990]  </IRQ>
[ 1178.907991] RIP: 0010:mwait_idle+0xae/0x370

If the NIC is not actually brought up, there is no need to schedule
selftest_work, so let's move invoking efx_selftest_async_start()
into efx_start_all(), and it will be canceled by broughting down.

Fixes: dd40781e ("sfc: Run event/IRQ self-test asynchronously when interface is brought up")
Fixes: e340be92 ("sfc: add ndo_set_vf_mac() function for EF10")
Debugged-by: default avatarHuang Cun <huangcun@sangfor.com.cn>
Cc: Donglin Peng <pengdonglin@sangfor.com.cn>
Suggested-by: default avatarMartin Habets <habetsm.xilinx@gmail.com>
Signed-off-by: default avatarDing Hui <dinghui@sangfor.com.cn>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 853618d5
...@@ -541,7 +541,6 @@ int efx_net_open(struct net_device *net_dev) ...@@ -541,7 +541,6 @@ int efx_net_open(struct net_device *net_dev)
else else
efx->state = STATE_NET_UP; efx->state = STATE_NET_UP;
efx_selftest_async_start(efx);
return 0; return 0;
} }
......
...@@ -544,6 +544,8 @@ void efx_start_all(struct efx_nic *efx) ...@@ -544,6 +544,8 @@ void efx_start_all(struct efx_nic *efx)
/* Start the hardware monitor if there is one */ /* Start the hardware monitor if there is one */
efx_start_monitor(efx); efx_start_monitor(efx);
efx_selftest_async_start(efx);
/* Link state detection is normally event-driven; we have /* Link state detection is normally event-driven; we have
* to poll now because we could have missed a change * to poll now because we could have missed a change
*/ */
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment