Patch "net/smc: fix application data exception" has been added to the 6.1-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    net/smc: fix application data exception

to the 6.1-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     net-smc-fix-application-data-exception.patch
and it can be found in the queue-6.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit d87d46c9644cc4c2b8e55a4781e8240f6fe4fc0e
Author: D. Wythe <alibuda@xxxxxxxxxxxxxxxxx>
Date:   Thu Feb 16 14:39:05 2023 +0800

    net/smc: fix application data exception
    
    [ Upstream commit 475f9ff63ee8c296aa46c6e9e9ad9bdd301c6bdf ]
    
    There is a certain probability that following
    exceptions will occur in the wrk benchmark test:
    
    Running 10s test @ http://11.213.45.6:80
      8 threads and 64 connections
      Thread Stats   Avg      Stdev     Max   +/- Stdev
        Latency     3.72ms   13.94ms 245.33ms   94.17%
        Req/Sec     1.96k   713.67     5.41k    75.16%
      155262 requests in 10.10s, 23.10MB read
    Non-2xx or 3xx responses: 3
    
    We will find that the error is HTTP 400 error, which is a serious
    exception in our test, which means the application data was
    corrupted.
    
    Consider the following scenarios:
    
    CPU0                            CPU1
    
    buf_desc->used = 0;
                                    cmpxchg(buf_desc->used, 0, 1)
                                    deal_with(buf_desc)
    
    memset(buf_desc->cpu_addr,0);
    
    This will cause the data received by a victim connection to be cleared,
    thus triggering an HTTP 400 error in the server.
    
    This patch exchange the order between clear used and memset, add
    barrier to ensure memory consistency.
    
    Fixes: 1c5526968e27 ("net/smc: Clear memory when release and reuse buffer")
    Signed-off-by: D. Wythe <alibuda@xxxxxxxxxxxxxxxxx>
    Reviewed-by: Wenjia Zhang <wenjia@xxxxxxxxxxxxx>
    Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c
index c305d8dd23f80..c19d4b7c1f28a 100644
--- a/net/smc/smc_core.c
+++ b/net/smc/smc_core.c
@@ -1120,8 +1120,9 @@ static void smcr_buf_unuse(struct smc_buf_desc *buf_desc, bool is_rmb,
 
 		smc_buf_free(lgr, is_rmb, buf_desc);
 	} else {
-		buf_desc->used = 0;
-		memset(buf_desc->cpu_addr, 0, buf_desc->len);
+		/* memzero_explicit provides potential memory barrier semantics */
+		memzero_explicit(buf_desc->cpu_addr, buf_desc->len);
+		WRITE_ONCE(buf_desc->used, 0);
 	}
 }
 
@@ -1132,19 +1133,17 @@ static void smc_buf_unuse(struct smc_connection *conn,
 		if (!lgr->is_smcd && conn->sndbuf_desc->is_vm) {
 			smcr_buf_unuse(conn->sndbuf_desc, false, lgr);
 		} else {
-			conn->sndbuf_desc->used = 0;
-			memset(conn->sndbuf_desc->cpu_addr, 0,
-			       conn->sndbuf_desc->len);
+			memzero_explicit(conn->sndbuf_desc->cpu_addr, conn->sndbuf_desc->len);
+			WRITE_ONCE(conn->sndbuf_desc->used, 0);
 		}
 	}
 	if (conn->rmb_desc) {
 		if (!lgr->is_smcd) {
 			smcr_buf_unuse(conn->rmb_desc, true, lgr);
 		} else {
-			conn->rmb_desc->used = 0;
-			memset(conn->rmb_desc->cpu_addr, 0,
-			       conn->rmb_desc->len +
-			       sizeof(struct smcd_cdc_msg));
+			memzero_explicit(conn->rmb_desc->cpu_addr,
+					 conn->rmb_desc->len + sizeof(struct smcd_cdc_msg));
+			WRITE_ONCE(conn->rmb_desc->used, 0);
 		}
 	}
 }