netdev - Re: [PATCH net] net: devlink: fix UAF in devlink_compat_running

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 1 Dec 2022 09:40:00 +0100
From:   Jiri Pirko <jiri@...nulli.us>
To:     Leon Romanovsky <leon@...nel.org>
Cc:     Jakub Kicinski <kuba@...nel.org>, Ido Schimmel <idosch@...sch.org>,
        Yang Yingliang <yangyingliang@...wei.com>,
        netdev@...r.kernel.org, jiri@...dia.com, davem@...emloft.net,
        edumazet@...gle.com, pabeni@...hat.com
Subject: Re: [PATCH net] net: devlink: fix UAF in
 devlink_compat_running_version()

Wed, Nov 30, 2022 at 08:20:34PM CET, leon@...nel.org wrote:
>On Wed, Nov 30, 2022 at 09:20:42AM -0800, Jakub Kicinski wrote:
>> On Wed, 30 Nov 2022 18:00:05 +0100 Jiri Pirko wrote:
>> > Wed, Nov 30, 2022 at 05:46:59PM CET, kuba@...nel.org wrote:
>> > >On Wed, 30 Nov 2022 12:42:39 +0100 Jiri Pirko wrote:  
>> > >> **)
>> > >> I see. With the change I suggest, meaning doing
>> > >> devlink_port_register/unregister() and netdev_register/unregister only
>> > >> for registered devlink instance, you don't need this at all. When you
>> > >> hit this compat callback, the netdevice is there and therefore devlink
>> > >> instance is registered for sure.  
>> > >
>> > >If you move devlink registration up it has to be under the instance
>> > >lock, otherwise we're back to reload problems. That implies unregister
>> > >should be under the lock too. But then we can't wait for refs in
>> > >unregister. Perhaps I don't understand the suggestion.  
>> > 
>> > I unlock for register and for the rest of the init I lock again.
>> 
>> The moment you register that instance callbacks can start coming.
>> Leon move the register call last for a good reason - all drivers
>> we looked at had bugs in handling init.
>
>Plus we had very cozy lock->unlock->lock sequences during devlink
>command execution, which caused to races between devlink calls
>and driver initialization.

So? Why do you think it is a problem?

>
>So I'm also interested to see what Jiri meant by saying "I unlock for
>register and for the rest of the init I lock again".
>
>Thanks