From: Leon Romanovsky <leon@kernel.org>
To: Junxian Huang <huangjunxian6@hisilicon.com>
Cc: Jason Gunthorpe <jgg@ziepe.ca>,
linux-rdma@vger.kernel.org, linuxarm@huawei.com,
tangchengchang@huawei.com
Subject: Re: [PATCH for-next 0/4] RDMA/hns: Introduce delay-destruction mechanism
Date: Wed, 26 Feb 2025 14:47:32 +0200 [thread overview]
Message-ID: <20250226124732.GJ53094@unreal> (raw)
In-Reply-To: <f5e1b589-d9a6-04c4-dffd-9aa3d2e77ab1@hisilicon.com>
On Wed, Feb 26, 2025 at 05:46:12PM +0800, Junxian Huang wrote:
>
>
> On 2025/2/20 22:10, Jason Gunthorpe wrote:
> > On Thu, Feb 20, 2025 at 11:48:49AM +0800, Junxian Huang wrote:
> >
> >> Driver notifies HW about the memory release with mailbox. The procedure
> >> of a mailbox is:
> >> a) driver posts the mailbox to FW
> >> b) FW writes the mailbox data into HW
> >>
> >> In this scenario, step a) will fail due to the FW reset, HW won't get
> >> notified and thus may lead to UAF.
> >
> > That's just wrong, a FW reset must fully stop and sanitize the HW as
> > well. You can't have HW running rouge with no way for FW to control it
> > anymore.
> >
>
> I agree, but there is a small time gap between the start of FW reset
> and the stop of HW. Please see my earlier reply today.
So stop HW before continuing FW reset.
Thanks
>
> Thanks,
> Junxian
>
> > Jason
next prev parent reply other threads:[~2025-02-26 12:47 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-02-17 7:01 [PATCH for-next 0/4] RDMA/hns: Introduce delay-destruction mechanism Junxian Huang
2025-02-17 7:01 ` [PATCH for-next 1/4] RDMA/hns: Change mtr member to pointer in hns QP/CQ/MR/SRQ/EQ struct Junxian Huang
2025-02-17 7:01 ` [PATCH for-next 2/4] RDMA/hns: Fix HW CTX UAF by adding delay-destruction mechanism Junxian Huang
2025-02-17 7:01 ` [PATCH for-next 3/4] RDMA/hns: Fix HW doorbell " Junxian Huang
2025-02-17 7:01 ` [PATCH for-next 4/4] Revert "RDMA/hns: Do not destroy QP resources in the hw resetting phase" Junxian Huang
2025-02-19 12:14 ` [PATCH for-next 0/4] RDMA/hns: Introduce delay-destruction mechanism Leon Romanovsky
2025-02-19 13:07 ` Junxian Huang
2025-02-19 14:35 ` Leon Romanovsky
2025-02-20 3:48 ` Junxian Huang
2025-02-20 7:32 ` Leon Romanovsky
2025-02-20 8:45 ` Junxian Huang
2025-02-20 9:08 ` Leon Romanovsky
2025-02-20 11:05 ` Junxian Huang
2025-02-20 14:13 ` Jason Gunthorpe
2025-02-26 9:38 ` Junxian Huang
2025-02-20 14:10 ` Jason Gunthorpe
2025-02-26 9:46 ` Junxian Huang
2025-02-26 12:47 ` Leon Romanovsky [this message]
2025-02-26 14:25 ` Junxian Huang
2025-03-18 3:23 ` Junxian Huang
2025-03-18 9:55 ` Leon Romanovsky
2025-04-01 13:39 ` Jason Gunthorpe
2025-04-02 5:50 ` Junxian Huang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250226124732.GJ53094@unreal \
--to=leon@kernel.org \
--cc=huangjunxian6@hisilicon.com \
--cc=jgg@ziepe.ca \
--cc=linux-rdma@vger.kernel.org \
--cc=linuxarm@huawei.com \
--cc=tangchengchang@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.