linux-kernel - Re: [PATCH] Netvsc: Call hv_unmap_memory() in the netvsc_device

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 8 Feb 2022 22:19:19 +0800
From:   Tianyu Lan <ltykernel@...il.com>
To:     "Michael Kelley (LINUX)" <mikelley@...rosoft.com>,
        KY Srinivasan <kys@...rosoft.com>,
        Haiyang Zhang <haiyangz@...rosoft.com>,
        Stephen Hemminger <sthemmin@...rosoft.com>,
        "wei.liu@...nel.org" <wei.liu@...nel.org>,
        Dexuan Cui <decui@...rosoft.com>,
        "tglx@...utronix.de" <tglx@...utronix.de>,
        "mingo@...hat.com" <mingo@...hat.com>,
        "bp@...en8.de" <bp@...en8.de>,
        "dave.hansen@...ux.intel.com" <dave.hansen@...ux.intel.com>,
        "x86@...nel.org" <x86@...nel.org>, "hpa@...or.com" <hpa@...or.com>,
        "davem@...emloft.net" <davem@...emloft.net>,
        "kuba@...nel.org" <kuba@...nel.org>,
        "hch@...radead.org" <hch@...radead.org>,
        "m.szyprowski@...sung.com" <m.szyprowski@...sung.com>,
        "robin.murphy@....com" <robin.murphy@....com>
Cc:     Tianyu Lan <Tianyu.Lan@...rosoft.com>,
        "iommu@...ts.linux-foundation.org" <iommu@...ts.linux-foundation.org>,
        "linux-hyperv@...r.kernel.org" <linux-hyperv@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>
Subject: Re: [PATCH] Netvsc: Call hv_unmap_memory() in the
 netvsc_device_remove()

On 2/3/2022 1:05 AM, Michael Kelley (LINUX) wrote:
> From: Tianyu Lan<ltykernel@...il.com>  Sent: Tuesday, February 1, 2022 8:32 AM
>> netvsc_device_remove() calls vunmap() inside which should not be
>> called in the interrupt context. Current code calls hv_unmap_memory()
>> in the free_netvsc_device() which is rcu callback and maybe called
>> in the interrupt context. This will trigger BUG_ON(in_interrupt())
>> in the vunmap(). Fix it via moving hv_unmap_memory() to netvsc_device_
>> remove().
> I think this change can fail to call hv_unmap_memory() in an error case.
> 
> If netvsc_init_buf() fails after hv_map_memory() succeeds for the receive
> buffer or for the send buffer, no corresponding hv_unmap_memory() will
> be done.  The failure in netvsc_init_buf() will cause netvsc_connect_vsp()
> to fail, so netvsc_add_device() will "goto close" where free_netvsc_device()
> will be called.  But free_netvsc_device() no longer calls hv_unmap_memory(),
> so it won't ever happen.   netvsc_device_remove() is never called in this case
> because netvsc_add_device() failed.
> 

Hi Michael:
       Thanks for your review. Nice catch and will fix in the next
version.