linux-kernel - [PATCH net] hv_netvsc: Fix XDP refcnt for synthetic and VF NICs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Thu,  6 Feb 2020 14:01:05 -0800
From:   Haiyang Zhang <haiyangz@...rosoft.com>
To:     sashal@...nel.org, linux-hyperv@...r.kernel.org,
        netdev@...r.kernel.org
Cc:     haiyangz@...rosoft.com, kys@...rosoft.com, sthemmin@...rosoft.com,
        olaf@...fle.de, vkuznets@...hat.com, davem@...emloft.net,
        linux-kernel@...r.kernel.org
Subject: [PATCH net] hv_netvsc: Fix XDP refcnt for synthetic and VF NICs

The caller of XDP_SETUP_PROG has already incremented refcnt in
__bpf_prog_get(), so drivers should only increment refcnt by
num_queues - 1.

To fix the issue, update netvsc_xdp_set() to add the correct number
to refcnt.

Hold a refcnt in netvsc_xdp_set()’s other caller, netvsc_attach().

And, do the same in netvsc_vf_setxdp(). Otherwise, every time when VF is
removed and added from the host side, the refcnt will be decreased by one,
which may cause page fault when unloading xdp program.

Fixes: 351e1581395f ("hv_netvsc: Add XDP support")
Signed-off-by: Haiyang Zhang <haiyangz@...rosoft.com>
---
 drivers/net/hyperv/netvsc_bpf.c | 13 +++++++++++--
 drivers/net/hyperv/netvsc_drv.c |  5 ++++-
 2 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/drivers/net/hyperv/netvsc_bpf.c b/drivers/net/hyperv/netvsc_bpf.c
index 20adfe5..b866110 100644
--- a/drivers/net/hyperv/netvsc_bpf.c
+++ b/drivers/net/hyperv/netvsc_bpf.c
@@ -120,7 +120,7 @@ int netvsc_xdp_set(struct net_device *dev, struct bpf_prog *prog,
 	}
 
 	if (prog)
-		bpf_prog_add(prog, nvdev->num_chn);
+		bpf_prog_add(prog, nvdev->num_chn - 1);
 
 	for (i = 0; i < nvdev->num_chn; i++)
 		rcu_assign_pointer(nvdev->chan_table[i].bpf_prog, prog);
@@ -136,6 +136,7 @@ int netvsc_vf_setxdp(struct net_device *vf_netdev, struct bpf_prog *prog)
 {
 	struct netdev_bpf xdp;
 	bpf_op_t ndo_bpf;
+	int ret;
 
 	ASSERT_RTNL();
 
@@ -148,10 +149,18 @@ int netvsc_vf_setxdp(struct net_device *vf_netdev, struct bpf_prog *prog)
 
 	memset(&xdp, 0, sizeof(xdp));
 
+	if (prog)
+		bpf_prog_inc(prog);
+
 	xdp.command = XDP_SETUP_PROG;
 	xdp.prog = prog;
 
-	return ndo_bpf(vf_netdev, &xdp);
+	ret = ndo_bpf(vf_netdev, &xdp);
+
+	if (ret && prog)
+		bpf_prog_put(prog);
+
+	return ret;
 }
 
 static u32 netvsc_xdp_query(struct netvsc_device *nvdev)
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index 8fc71bd..65e12cb 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -1059,9 +1059,12 @@ static int netvsc_attach(struct net_device *ndev,
 
 	prog = dev_info->bprog;
 	if (prog) {
+		bpf_prog_inc(prog);
 		ret = netvsc_xdp_set(ndev, prog, NULL, nvdev);
-		if (ret)
+		if (ret) {
+			bpf_prog_put(prog);
 			goto err1;
+		}
 	}
 
 	/* In any case device is now ready */
-- 
1.8.3.1