linux-kernel - Re: [PATCH v4] IB/hfi1: allocate dummy net

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Wed, 3 Apr 2024 05:15:10 -0700
From: Breno Leitao <leitao@...ian.org>
To: Dennis Dalessandro <dennis.dalessandro@...nelisnetworks.com>
Cc: Jakub Kicinski <kuba@...nel.org>, Leon Romanovsky <leon@...nel.org>,
	Jason Gunthorpe <jgg@...pe.ca>, keescook@...omium.org,
	"open list:HFI1 DRIVER" <linux-rdma@...r.kernel.org>,
	open list <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v4] IB/hfi1: allocate dummy net_device dynamically

On Mon, Apr 01, 2024 at 11:34:23AM -0400, Dennis Dalessandro wrote:
> On 4/1/24 10:53 AM, Jakub Kicinski wrote:
> > On Mon, 1 Apr 2024 14:53:31 +0300 Leon Romanovsky wrote:
> >> On Tue, Mar 19, 2024 at 02:09:43AM -0700, Breno Leitao wrote:
> >>> Embedding net_device into structures prohibits the usage of flexible
> >>> arrays in the net_device structure. For more details, see the discussion
> >>> at [1].
> >>>
> >>> Un-embed the net_device from struct hfi1_netdev_rx by converting it
> >>> into a pointer. Then use the leverage alloc_netdev() to allocate the
> >>> net_device object at hfi1_alloc_rx().
> >>>
> >>> [1] https://lore.kernel.org/all/20240229225910.79e224cf@kernel.org/
> >>>
> >>> Signed-off-by: Breno Leitao <leitao@...ian.org>
> >>> Acked-by: Dennis Dalessandro <dennis.dalessandro@...nelisnetworks.com>  
> >>
> >> Jakub,
> >>
> >> I create shared branch for you, please pull it from:
> >> https://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git/log/?h=remove-dummy-netdev
> > 
> > Did you merge it in already?
> > Turned out that the use of init_dummy_netdev as a setup function
> > is broken, I'm not sure how Dennis tested this :(
> > We should have pinged you, sorry.
> 
> This is what I tested, Linus 6.8 tag + cherry pick + Breno patch. So if
> something went in that broke it I didn't have it in my tree.
> 
> commit 311810a6d7e37d8e7537d50e26197b7f5f02f164 (linus-master)
> Author: Breno Leitao <leitao@...ian.org>
> Date:   Wed Mar 13 03:33:10 2024 -0700
> 
>     IB/hfi1: allocate dummy net_device dynamically

This one has a potential bug that causes a kernel panic when the module
is removed.

This is because alloc_netdev() allocates some data structures that are
later overwritten (memset) by init_dummy_netdev(). At the free time,
free_netdev() will dereference those structures and they are zero.

A new upcoming patch is creating a helper (init_dummy_netdev()) that
will allocate the netdev and call a special version of
init_dummy_netdev() without memsetting the structure.

I would drop this patch for now, and I will submit a new version using
the new helper.