[hns3-0120]pad the short frame before sending to the hardware

Bug #1860320 reported by Fred Kimmy
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
kunpeng920
Fix Released
Undecided
Unassigned
Ubuntu-18.04
Fix Released
Undecided
Taihsiang Ho
Ubuntu-18.04-hwe
Fix Released
Undecided
Taihsiang Ho
Upstream-kernel
Fix Released
Undecided
Taihsiang Ho
linux (Ubuntu)
Fix Released
Undecided
Unassigned
Bionic
Fix Released
Undecided
Taihsiang Ho

Bug Description

The hardware can not handle short frames below or equal to 32
bytes.

[Impact]
The system may hang or endless event log in /var/log/syslog

[Fix]
Cherry-pick or backport the upstream fix 36c67349a1a1c88b9cf11d7ca7762ababdb38867 net: hns3: pad the short frame before sending to the hardware

[Test Case]
Send a frame less than 33 bytes.

[Regression Risk]
Low, the patch is only specific to the hns3 driver.

====== Original Bug Description ======

[Bug Description]
The hardware can not handle short frames below or equal to 32
bytes according to the hardware user manual, and it will trigger
a RAS error when the frame's length is below 33 bytes.

[Steps to Reproduce]
1.send a frame less than 33 bytes.

[Actual Results]
a RAS occurs

[Expected Results]
no RAS

[Reproducibility]
Inevitably

[Additional information]
Hardware: D06
Firmware: NA
Kernel: NA

[Resolution]
pads the SKB when skb->len is below 33 bytes before sending it to hardware.

net: hns3: pad the short frame before sending to the hardware

CVE References

Revision history for this message
Taihsiang Ho (tai271828) wrote :

The patch has been in ubuntu focal

commit 0e282454804fc4d1de2ae6847d292da6b67f45c1
Author: Yunsheng Lin <email address hidden>
Date: Wed Jan 15 10:46:45 2020 +0800

    net: hns3: pad the short frame before sending to the hardware

    BugLink: https://bugs.launchpad.net/bugs/1861090

    [ Upstream commit 36c67349a1a1c88b9cf11d7ca7762ababdb38867 ]

    The hardware can not handle short frames below or equal to 32
    bytes according to the hardware user manual, and it will trigger
    a RAS error when the frame's length is below 33 bytes.

    This patch pads the SKB when skb->len is below 33 bytes before
    sending it to hardware.

    Fixes: 76ad4f0ee747 ("net: hns3: Add support of HNS3 Ethernet Driver for hip08 SoC")
    Signed-off-by: Yunsheng Lin <email address hidden>
    Signed-off-by: Huazhong Tan <email address hidden>
    Signed-off-by: David S. Miller <email address hidden>
    Signed-off-by: Greg Kroah-Hartman <email address hidden>
    Signed-off-by: Paolo Pisati <email address hidden>

Revision history for this message
Taihsiang Ho (tai271828) wrote :

The patch has not been in bionic-hwe Ubuntu-hwe-5.3.0-40.32~18.04.1.

Taihsiang Ho (tai271828)
description: updated
Taihsiang Ho (tai271828)
description: updated
Revision history for this message
Taihsiang Ho (tai271828) wrote :

The patch backported to 18.04. Verified on d06-2 by sending frames < 33 bytes over raw socket to ethernet interface.

Ike Panhc (ikepanhc)
Changed in kunpeng920:
status: New → In Progress
Changed in linux (Ubuntu Bionic):
status: New → In Progress
assignee: nobody → Taihsiang Ho (taihsiangho)
Revision history for this message
Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote : Missing required logs.

This bug is missing log files that will aid in diagnosing the problem. While running an Ubuntu kernel (not a mainline or third-party kernel) please enter the following command in a terminal window:

apport-collect 1860320

and then change the status of the bug to 'Confirmed'.

If, due to the nature of the issue you have encountered, you are unable to run this command, please add a comment stating that fact and change the bug status to 'Confirmed'.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.

Changed in linux (Ubuntu):
status: New → Incomplete
tags: added: patch
Revision history for this message
Ike Panhc (ikepanhc) wrote :

In focal kernel already.

$ gitoneline origin/master-next | grep 'pad the short frame before sending'
0e282454804f <email address hidden> 2020-01-30 16:26:32 +0100 net: hns3: pad the short frame before sending to the hardware

Changed in linux (Ubuntu):
status: Incomplete → Fix Released
Revision history for this message
Taihsiang Ho (tai271828) wrote :

In eoan kernel already.

$ git log --grep="net: hns3: pad the short frame before sending to the hardware"
commit 39d592aa888b3cfe3bca86b524775e4d5b8c96fc
Author: Yunsheng Lin <email address hidden>
Date: Wed Jan 15 10:46:45 2020 +0800

    net: hns3: pad the short frame before sending to the hardware

    BugLink: https://bugs.launchpad.net/bugs/1862429

    [ Upstream commit 36c67349a1a1c88b9cf11d7ca7762ababdb38867 ]

    The hardware can not handle short frames below or equal to 32
    bytes according to the hardware user manual, and it will trigger
    a RAS error when the frame's length is below 33 bytes.

    This patch pads the SKB when skb->len is below 33 bytes before
    sending it to hardware.

    Fixes: 76ad4f0ee747 ("net: hns3: Add support of HNS3 Ethernet Driver for hip08 SoC")
    Signed-off-by: Yunsheng Lin <email address hidden>
    Signed-off-by: Huazhong Tan <email address hidden>
    Signed-off-by: David S. Miller <email address hidden>
    Signed-off-by: Greg Kroah-Hartman <email address hidden>
    Signed-off-by: Kamal Mostafa <email address hidden>
    Signed-off-by: Khalid Elmously <email address hidden>

Taihsiang Ho (tai271828)
Changed in linux (Ubuntu Bionic):
status: In Progress → Fix Committed
status: Fix Committed → In Progress
tags: added: tairadar
Revision history for this message
Taihsiang Ho (tai271828) wrote :

The patch in Eoan is merged over stable channel https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1862429

Revision history for this message
Taihsiang Ho (tai271828) wrote :

The fix is expected to land bionic-hwe after this SRU cycle completes

---

bionic-hwe kernel tagged Ubuntu-hwe-5.3.0-41.33_18.04.1 and/or Ubuntu-hwe-5.3.0-42.34_18.04.1 have the upstream patch.

    $ git remote -v
    lp git+ssh://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/bionic (fetch)
    lp git+ssh://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/bionic (push)

    $ git log lp/hwe --abbrev-commit --pretty=oneline --grep "net: hns3: pad the short frame before sending to the hardware"
    39d592aa888b net: hns3: pad the short frame before sending to the hardware

    $ git tag --list --contains 39d592aa888b
    Ubuntu-hwe-5.3.0-41.33_18.04.1
    Ubuntu-hwe-5.3.0-42.34_18.04.1
    Ubuntu-raspi2-5.3-5.3.0-1019.21_18.04.1

    $ rmadison linux-generic-hwe-18.04
     linux-generic-hwe-18.04 | 5.3.0.40.97 | bionic-security | amd64, arm64, armhf, i386, ppc64el, s390x
     linux-generic-hwe-18.04 | 5.3.0.40.97 | bionic-updates | amd64, arm64, armhf, i386, ppc64el, s390x
     linux-generic-hwe-18.04 | 5.3.0.42.99 | bionic-proposed | amd64, arm64, armhf, i386, ppc64el, s390x
     linux-generic-hwe-18.04 | 5.4.0.14.17 | focal | amd64, arm64, armhf, ppc64el, s390x
     linux-generic-hwe-18.04 | 5.4.0.17.21 | focal-proposed | amd64, arm64, armhf, ppc64el, s390x

And
    "d06-1 5.3.0-40-generic #32~18.04.1-Ubuntu SMP Mon Feb 3 14:08:05 UTC 2020"
could reproduce this issue. /var/log/syslog will output endless log of message
    "Mar 3 15:39:35 d06-1 kernel: [ 6305.142251] hns3 0000:7d:00.2: received event 0x400")

Revision history for this message
Taihsiang Ho (tai271828) wrote :

The fix is expected to hit eoan 5.3 kernel after this SRU completes

    $ rmadison -asource linux | grep eoan
     linux | 5.3.0-18.19 | eoan | source
     linux | 5.3.0-40.32 | eoan-security | source
     linux | 5.3.0-40.32 | eoan-updates | source
     linux | 5.3.0-42.34 | eoan-proposed | source

    $ git log upstream/master-next --abbrev-commit --pretty=oneline --grep "net: hns3: pad the short frame before sending to the hardware"
    39d592aa888b net: hns3: pad the short frame before sending to the hardware

    $ git tag --list --contains 39d592aa888b
    Ubuntu-5.3.0-41.33
    Ubuntu-5.3.0-42.34
    Ubuntu-raspi2-5.3.0-1019.21

    $ git remote -v
    upstream git+ssh://<email address hidden>/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan (fetch)
    upstream git+ssh://<email address hidden>/~ubuntu-kernel/ubuntu/+source/linux/+git/eoan (push)

Revision history for this message
Taihsiang Ho (tai271828) wrote :

Current upstream status has this fix commit

    $ git log upstream/master --abbrev-commit --pretty=oneline --grep "net: hns3: pad the short frame before sending to the hardware"
    36c67349a1a1 net: hns3: pad the short frame before sending to the hardware

    $ git tag --list --contains 36c67349a1a1
    v5.5
    v5.5-rc7
    v5.5.1
    v5.5.2
    v5.5.3
    v5.5.4
    v5.5.5
    v5.5.6
    v5.5.7
    v5.6-rc1
    v5.6-rc2
    v5.6-rc3
    v5.6-rc4

    $ git remote -v
    upstream git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git (fetch)
    upstream git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git (push)

Changed in linux (Ubuntu Bionic):
status: In Progress → Fix Committed
Revision history for this message
Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote :

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-bionic' to 'verification-done-bionic'. If the problem still exists, change the tag 'verification-needed-bionic' to 'verification-failed-bionic'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags: added: verification-needed-bionic
Changed in kunpeng920:
status: In Progress → Fix Committed
Revision history for this message
Taihsiang Ho (tai271828) wrote :

Verified and the bug is fixed.

- 4.15.0-92-generic, scobee
- 4.15.0-92-generic, d06-2

tags: added: verification-done-bionic
removed: verification-needed-bionic
Revision history for this message
Taihsiang Ho (tai271828) wrote :

I also verified 18.04-hwe 5.3.0-42-generic #34~18.04.1-Ubuntu fixes this issue ( 5.3.0-40-generic #32~18.04.1-Ubuntu still has this issue). Verified on d06-1.

Revision history for this message
Launchpad Janitor (janitor) wrote :
Download full text (27.7 KiB)

This bug was fixed in the package linux - 4.15.0-96.97

---------------
linux (4.15.0-96.97) bionic; urgency=medium

  * CVE-2020-8834
    - KVM: PPC: Book3S HV: Factor fake-suspend handling out of
      kvmppc_save/restore_tm
    - KVM: PPC: Book3S PR: Move kvmppc_save_tm/kvmppc_restore_tm to separate file
    - KVM: PPC: Book3S PR: Add guest MSR parameter for
      kvmppc_save_tm()/kvmppc_restore_tm()

linux (4.15.0-94.95) bionic; urgency=medium

  * bionic/linux: 4.15.0-94.95 -proposed tracker (LP: #1868984)

  * Missing wireless network interface after kernel 5.3.0-43 upgrade with eoan
    (LP: #1868442)
    - iwlwifi: mvm: Do not require PHY_SKU NVM section for 3168 devices

linux (4.15.0-93.94) bionic; urgency=medium

  * bionic/linux: 4.15.0-93.94 -proposed tracker (LP: #1868764)

  * quotactl04 from ubuntu_ltp_syscalls failed with B (LP: #1868665)
    - ext4: fix mount failure with quota configured as module

linux (4.15.0-92.93) bionic; urgency=medium

  * bionic/linux: 4.15.0-92.93 -proposed tracker (LP: #1867272)

  * Packaging resync (LP: #1786013)
    - [Packaging] resync getabis
    - [Packaging] update helper scripts

  * Introduce the new NVIDIA 440 series, and add 5.4 Linux compatibility to the
    340 and 390 series (LP: #1854485)
    - [Packaging] NVIDIA -- add support for the 435 and the 440 series

  * Stop using get_scalar_status command in Dell AIO uart backlight driver
    (LP: #1865402)
    - SAUCE: platform/x86: dell-uart-backlight: add get_display_mode command

  * Bionic update: upstream stable patchset 2020-03-12 (LP: #1867194)
    - RDMA/core: Fix locking in ib_uverbs_event_read
    - gpio: zynq: Report gpio direction at boot
    - arm64: ptrace: nofpsimd: Fail FP/SIMD regset operations
    - KVM: arm: Fix DFSR setting for non-LPAE aarch32 guests
    - KVM: arm: Make inject_abt32() inject an external abort instead
    - mtd: onenand_base: Adjust indentation in onenand_read_ops_nolock
    - mtd: sharpslpart: Fix unsigned comparison to zero
    - padata: fix null pointer deref of pd->pinst
    - Input: synaptics - switch T470s to RMI4 by default
    - Input: synaptics - enable SMBus on ThinkPad L470
    - Input: synaptics - remove the LEN0049 dmi id from topbuttonpad list
    - ALSA: hda/realtek - Fix silent output on MSI-GL73
    - ALSA: usb-audio: Apply sample rate quirk for Audioengine D1
    - arm64: cpufeature: Set the FP/SIMD compat HWCAP bits properly
    - ALSA: usb-audio: sound: usb: usb true/false for bool return type
    - ext4: don't assume that mmp_nodename/bdevname have NUL
    - ext4: fix support for inode sizes > 1024 bytes
    - ext4: fix checksum errors with indexed dirs
    - ext4: add cond_resched() to ext4_protect_reserved_inode
    - ext4: improve explanation of a mount failure caused by a misconfigured
      kernel
    - Btrfs: fix race between using extent maps and merging them
    - btrfs: ref-verify: fix memory leaks
    - btrfs: print message when tree-log replay starts
    - btrfs: log message when rw remount is attempted with unclean tree-log
    - arm64: ssbs: Fix context-switch when SSBS is present on all CPUs
    - perf/x86/amd: Add missing L2 misses event spec to AMD Family 17h's ev...

Changed in linux (Ubuntu Bionic):
status: Fix Committed → Fix Released
Changed in kunpeng920:
status: Fix Committed → Fix Released
Taihsiang Ho (tai271828)
tags: removed: tairadar
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.