From: Jason Gunthorpe <jgg@ziepe.ca>
To: Junxian Huang <huangjunxian6@hisilicon.com>
Cc: Leon Romanovsky <leon@kernel.org>,
linux-rdma@vger.kernel.org, linuxarm@huawei.com,
tangchengchang@huawei.com
Subject: Re: [PATCH for-next 0/4] RDMA/hns: Introduce delay-destruction mechanism
Date: Thu, 20 Feb 2025 10:10:59 -0400 [thread overview]
Message-ID: <20250220141059.GV3696814@ziepe.ca> (raw)
In-Reply-To: <e8e09f3e-a8f9-429a-ac60-272db35f25fb@hisilicon.com>
On Thu, Feb 20, 2025 at 11:48:49AM +0800, Junxian Huang wrote:
> Driver notifies HW about the memory release with mailbox. The procedure
> of a mailbox is:
> a) driver posts the mailbox to FW
> b) FW writes the mailbox data into HW
>
> In this scenario, step a) will fail due to the FW reset, HW won't get
> notified and thus may lead to UAF.
That's just wrong, a FW reset must fully stop and sanitize the HW as
well. You can't have HW running rouge with no way for FW to control it
anymore.
Jason
next prev parent reply other threads:[~2025-02-20 14:11 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-02-17 7:01 [PATCH for-next 0/4] RDMA/hns: Introduce delay-destruction mechanism Junxian Huang
2025-02-17 7:01 ` [PATCH for-next 1/4] RDMA/hns: Change mtr member to pointer in hns QP/CQ/MR/SRQ/EQ struct Junxian Huang
2025-02-17 7:01 ` [PATCH for-next 2/4] RDMA/hns: Fix HW CTX UAF by adding delay-destruction mechanism Junxian Huang
2025-02-17 7:01 ` [PATCH for-next 3/4] RDMA/hns: Fix HW doorbell " Junxian Huang
2025-02-17 7:01 ` [PATCH for-next 4/4] Revert "RDMA/hns: Do not destroy QP resources in the hw resetting phase" Junxian Huang
2025-02-19 12:14 ` [PATCH for-next 0/4] RDMA/hns: Introduce delay-destruction mechanism Leon Romanovsky
2025-02-19 13:07 ` Junxian Huang
2025-02-19 14:35 ` Leon Romanovsky
2025-02-20 3:48 ` Junxian Huang
2025-02-20 7:32 ` Leon Romanovsky
2025-02-20 8:45 ` Junxian Huang
2025-02-20 9:08 ` Leon Romanovsky
2025-02-20 11:05 ` Junxian Huang
2025-02-20 14:13 ` Jason Gunthorpe
2025-02-26 9:38 ` Junxian Huang
2025-02-20 14:10 ` Jason Gunthorpe [this message]
2025-02-26 9:46 ` Junxian Huang
2025-02-26 12:47 ` Leon Romanovsky
2025-02-26 14:25 ` Junxian Huang
2025-03-18 3:23 ` Junxian Huang
2025-03-18 9:55 ` Leon Romanovsky
2025-04-01 13:39 ` Jason Gunthorpe
2025-04-02 5:50 ` Junxian Huang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250220141059.GV3696814@ziepe.ca \
--to=jgg@ziepe.ca \
--cc=huangjunxian6@hisilicon.com \
--cc=leon@kernel.org \
--cc=linux-rdma@vger.kernel.org \
--cc=linuxarm@huawei.com \
--cc=tangchengchang@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox