[PATCH] net/vmxnet3: Fix vmxnet3 NULL pointer deref after configuration failure

[Roger Melton (rmelton)]

On 10/30/24 4:28 PM, Roger Melton (rmelton) wrote:
> On 10/29/24 11:15 PM, Ferruh Yigit wrote:
>> On 10/26/2024 3:33 PM, Roger B Melton wrote:
>>> Problem:
>>>
>>> If vxmnet3_dev_configure() fails, applications may call
>>> vmxnet3_dev_close(). If the failure occurs before the vmxnet3
>>> hw->shared structure is allocated the close will lead to a segv.
>>>
>>> Root Cause:
>>>
>>> This crash is due to incorrect adapter_stopped state in the
>>> vmxnet3 dev_private structure. When dev_private is allocated,
>>> adapter_stopped will be 0 (FALSE).  eth_vmxnet3_dev_init() does not
>>> set it to TRUE, so it will remain FALSE until a successful
>>> vmxnet3_dev_start() followed by a vmxnet3_dev_stop().  When
>>> vmxnet3_dev_close() is called, it will invoke vmxnet3_dev_stop().
>>> vmxnet3_dev_stop() will check the adapter_stopped state in the
>>> vmxnet3 shared data, find it is FALSE and will proceed to stop the
>>> device, calling vmxnet3_disable_all_intrs().
>>> vmxnet3_disable_all_intrs() attempts to access the vmxnet3 shared data
>>> resulting in the segv.
>>>
>>> Solution:
>>>
>>> Set adapter_stopped to TRUE in eth_vmxnet3_dev_init(), to prevent stop
>>> processing.
>>>
>>> Signed-off-by: Roger B Melton <rmelton at cisco.com>
>>> ---
>>>    drivers/net/vmxnet3/vmxnet3_ethdev.c | 1 +
>>>    1 file changed, 1 insertion(+)
>>>
>>> diff --git a/drivers/net/vmxnet3/vmxnet3_ethdev.c b/drivers/net/vmxnet3/vmxnet3_ethdev.c
>>> index 467fb61137..8d7f95a753 100644
>>> --- a/drivers/net/vmxnet3/vmxnet3_ethdev.c
>>> +++ b/drivers/net/vmxnet3/vmxnet3_ethdev.c
>>> @@ -403,6 +403,7 @@ eth_vmxnet3_dev_init(struct rte_eth_dev *eth_dev)
>>>    	/* Vendor and Device ID need to be set before init of shared code */
>>>    	hw->device_id = pci_dev->id.device_id;
>>>    	hw->vendor_id = pci_dev->id.vendor_id;
>>> +	hw->adapter_stopped = TRUE;
>>>    	hw->hw_addr0 = (void *)pci_dev->mem_resource[0].addr;
>>>    	hw->hw_addr1 = (void *)pci_dev->mem_resource[1].addr;
>>>    
>>
>> Hi Roger,
>>
>> Can you please provide fixes tag?
>>
> 
> Hi Ferruh,
> 
> I can do that.
> 
> Apologies for not including with the original submission. I didn't think
> fixes tag was required since the bug is present in the first import of
> vmxnet3 in v1.6.0r0.  See below.
> 
> -Roger
> 
> commit dfaff37fc46d6ef1700c44f03f38bf7dd24347e4
> Author: Bruce Richardson <bruce.richardson at intel.com>
> Date:   Mon Feb 10 15:27:26 2014 +0000
> 
>       vmxnet3: import new vmxnet3 poll mode driver implementation
> 
> 


Fixes: dfaff37fc4 ("vmxnet3: import new vmxnet3 poll mode driver implementation")