mlxbf-tmfifo: fix potential race

Bug #2016039 reported by Liming Sun
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
linux-bluefield (Ubuntu)
Invalid
Undecided
Unassigned
Focal
Fix Released
Medium
Unassigned
Jammy
Fix Committed
Medium
Unassigned

Bug Description

SRU Justification:

[Impact]
This change is needed to avoid potential race of accessing the 'vq' pointer

[Fix]
The fix adds memory barrier for the is_ready flag and the 'vq' pointer access in mlxbf_tmfifo_virtio_find_vqs(), so updated in vq will be visible before accessing this pointer.

[Test Case]
Same functionality and testing as on BlueField-1/2/2. No functionality change.

[Regression Potential]
Same behavior from user perspective.

Changed in linux-bluefield (Ubuntu):
status: New → Invalid
Changed in linux-bluefield (Ubuntu Jammy):
status: New → Fix Committed
Stefan Bader (smb)
Changed in linux-bluefield (Ubuntu Focal):
importance: Undecided → Medium
status: New → In Progress
Changed in linux-bluefield (Ubuntu Jammy):
importance: Undecided → Medium
Revision history for this message
Bartlomiej Zolnierkiewicz (bzolnier) wrote :

This bug is awaiting verification that the linux-bluefield/5.15.0-1019.21 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-jammy' to 'verification-done-jammy'. If the problem still exists, change the tag 'verification-needed-jammy' to 'verification-failed-jammy'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags: added: verification-needed-jammy
Liming Sun (limings)
tags: added: verification-done-jammy
removed: verification-needed-jammy
Changed in linux-bluefield (Ubuntu Focal):
status: In Progress → Fix Committed
Revision history for this message
Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote :

This bug is awaiting verification that the linux-bluefield/5.4.0-1068.74 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-focal' to 'verification-done-focal'. If the problem still exists, change the tag 'verification-needed-focal' to 'verification-failed-focal'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags: added: kernel-spammed-focal-linux-bluefield verification-needed-focal
Liming Sun (limings)
tags: added: verification-done-focal
removed: verification-needed-focal
Revision history for this message
Launchpad Janitor (janitor) wrote :
Download full text (22.7 KiB)

This bug was fixed in the package linux-bluefield - 5.4.0-1068.74

---------------
linux-bluefield (5.4.0-1068.74) focal; urgency=medium

  * focal/linux-bluefield: 5.4.0-1068.74 -proposed tracker (LP: #2026552)

  * mlxbf-tmfifo: fix potential race (LP: #2016039)
    - SAUCE: mlxbf-tmfifo: fix potential race

  * mlxbf-gige: Fix kernel panic at shutdown (LP: #2022370)
    - SAUCE: mlxbf-gige: Fix kernel panic at shutdown

  * net: openvswitch: fix race on port output (LP: #2020606)
    - net: openvswitch: fix race on port output

  * mlxbf-bootctl: support SMC call for setting ARM boot state (LP: #2013383)
    - SAUCE: mlxbf-bootctl: support SMC call for setting ARM boot state

  * mlxbf-gige: Fix intermittent no ip issue (LP: #2022387)
    - SAUCE: mlxbf-gige: Fix intermittent no ip issue

  * mlxbf-tmfifo: robust fix to drop over-sized packet or no Rx descriptors
    (LP: #2021749)
    - SAUCE: mlxbf-tmfifo: Drop the Rx packet if no more descriptors
    - SAUCE: mlxbf-tmfifo: Drop jumbo frames

  [ Ubuntu: 5.4.0-156.173 ]

  * focal/linux: 5.4.0-156.173 -proposed tracker (LP: #2026585)
  * CVE-2023-3390
    - netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE
  * Focal update: v5.4.241 upstream stable release (LP: #2023930)
    - scsi: ses: Handle enclosure with just a primary component gracefully
    - x86/PCI: Add quirk for AMD XHCI controller that loses MSI-X state in D3hot
    - cgroup/cpuset: Wake up cpuset_attach_wq tasks in cpuset_cancel_attach()
    - treewide: Replace DECLARE_TASKLET() with DECLARE_TASKLET_OLD()
    - smb3: fix problem with null cifs super block with previous patch
    - pinctrl: amd: Use irqchip template
    - pinctrl: amd: disable and mask interrupts on probe
    - pinctrl: amd: Disable and mask interrupts on resume
    - pwm: cros-ec: Explicitly set .polarity in .get_state()
    - pwm: sprd: Explicitly set .polarity in .get_state()
    - wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded
      sta
    - icmp: guard against too small mtu
    - net: don't let netpoll invoke NAPI if in xmit context
    - sctp: check send stream number after wait_for_sndbuf
    - ipv6: Fix an uninit variable access bug in __ip6_make_skb()
    - gpio: davinci: Add irq chip flag to skip set wake
    - sunrpc: only free unix grouplist after RCU settles
    - NFSD: callback request does not use correct credential for AUTH_SYS
    - xhci: also avoid the XHCI_ZERO_64B_REGS quirk with a passthrough iommu
    - USB: serial: cp210x: add Silicon Labs IFS-USB-DATACABLE IDs
    - usb: typec: altmodes/displayport: Fix configure initial pin assignment
    - USB: serial: option: add Telit FE990 compositions
    - USB: serial: option: add Quectel RM500U-CN modem
    - iio: adc: ti-ads7950: Set `can_sleep` flag for GPIO chip
    - iio: dac: cio-dac: Fix max DAC write value check for 12-bit
    - tty: serial: sh-sci: Fix transmit end interrupt handler
    - tty: serial: sh-sci: Fix Rx on RZ/G2L SCI
    - tty: serial: fsl_lpuart: avoid checking for transfer complete when
      UARTCTRL_SBK is asserted in lpuart32_tx_empty
    - nilfs2: fix potential UAF of struct nilfs_sc_info in nilfs_segctor_thread()
   ...

Changed in linux-bluefield (Ubuntu Focal):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.