linux-kernel - Re: [PATCH net-next v2] net: phy: Fix suspicious rcu

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20250117231659.31a4b7fa@kmaincent-XPS-13-7390>
Date: Fri, 17 Jan 2025 23:16:59 +0100
From: Kory Maincent <kory.maincent@...tlin.com>
To: Eric Dumazet <edumazet@...gle.com>
Cc: "David S. Miller" <davem@...emloft.net>, netdev@...r.kernel.org,
 linux-kernel@...r.kernel.org, Claudiu Beznea
 <claudiu.beznea.uj@...renesas.com>, thomas.petazzoni@...tlin.com, Andrew
 Lunn <andrew@...n.ch>, Heiner Kallweit <hkallweit1@...il.com>, Russell King
 <linux@...linux.org.uk>, Jakub Kicinski <kuba@...nel.org>, Paolo Abeni
 <pabeni@...hat.com>
Subject: Re: [PATCH net-next v2] net: phy: Fix suspicious rcu_dereference
 usage

On Fri, 17 Jan 2025 20:06:28 +0100
Eric Dumazet <edumazet@...gle.com> wrote:

> On Fri, Jan 17, 2025 at 6:36 PM Kory Maincent <kory.maincent@...tlin.com>
> wrote:
> >
> > The phy_detach function can be called with or without the rtnl lock held.
> > When the rtnl lock is not held, using rtnl_dereference() triggers a
> > warning due to the lack of lock context.
> >
> > Add an rcu_read_lock() to ensure the lock is acquired and to maintain
> > synchronization.
> >
> > Tested-by: Claudiu Beznea <claudiu.beznea.uj@...renesas.com>
> > Reported-by: Claudiu Beznea <claudiu.beznea.uj@...renesas.com>
> > Closes:
> > https://lore.kernel.org/netdev/4c6419d8-c06b-495c-b987-d66c2e1ff848@tuxon.dev/
> > Fixes: 35f7cad1743e ("net: Add the possibility to support a selected
> > hwtstamp in netdevice") Signed-off-by: Kory Maincent
> > <kory.maincent@...tlin.com> ---
> >
> > Changes in v2:
> > - Add a missing ;
> > ---
> >  drivers/net/phy/phy_device.c | 4 +++-
> >  1 file changed, 3 insertions(+), 1 deletion(-)
> >
> > diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
> > index 5b34d39d1d52..3eeee7cba923 100644
> > --- a/drivers/net/phy/phy_device.c
> > +++ b/drivers/net/phy/phy_device.c
> > @@ -2001,12 +2001,14 @@ void phy_detach(struct phy_device *phydev)
> >         if (dev) {
> >                 struct hwtstamp_provider *hwprov;
> >
> > -               hwprov = rtnl_dereference(dev->hwprov);
> > +               rcu_read_lock();
> > +               hwprov = rcu_dereference(dev->hwprov);
> >                 /* Disable timestamp if it is the one selected */
> >                 if (hwprov && hwprov->phydev == phydev) {
> >                         rcu_assign_pointer(dev->hwprov, NULL);
> >                         kfree_rcu(hwprov, rcu_head);
> >                 }
> > +               rcu_read_unlock();
> >
> >                 phydev->attached_dev->phydev = NULL;
> >                 phydev->attached_dev = NULL;
> > --
> > 2.34.1
> >  
> 
> If not protected by RTNL, what prevents two threads from calling this
> function at the same time,
> thus attempting to kfree_rcu() the same pointer twice ?

I don't think this function can be called simultaneously from two threads,
if this were the case we would have already seen several issues with the phydev
pointer. But maybe I am wrong.

The rcu_lock here is to prevent concurrent dev->hwprov pointer modification done
under rtnl_lock in net/ethtool/tsconfig.c.

Regards,
-- 
Köry Maincent, Bootlin
Embedded Linux and kernel engineering
https://bootlin.com