linux-kernel - Re: [PATCH] nfp: nfp_alloc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAC1kPDMkYdPVy-dG3uv92-JG2Ui8BxRqYt2U86ey7fKuJxBa0w@mail.gmail.com>
Date: Tue, 1 Jul 2025 15:45:03 +0800
From: Chen Linxuan <chenlinxuan@...ontech.com>
To: Jakub Kicinski <kuba@...nel.org>
Cc: WangYuli <wangyuli@...ontech.com>, louis.peens@...igine.com, andrew+netdev@...n.ch, 
	davem@...emloft.net, edumazet@...gle.com, pabeni@...hat.com, 
	chenlinxuan@...ontech.com, viro@...iv.linux.org.uk, oss-drivers@...igine.com, 
	netdev@...r.kernel.org, linux-kernel@...r.kernel.org, 
	guanwentao@...ontech.com, niecheng1@...ontech.com, 
	Jun Zhan <zhanjun@...ontech.com>
Subject: Re: [PATCH] nfp: nfp_alloc_bar: Fix double unlock

On Tue, Jun 24, 2025 at 4:12 AM Jakub Kicinski <kuba@...nel.org> wrote:
>
> On Mon, 23 Jun 2025 12:11:04 +0800 WangYuli wrote:
> > The lock management in the nfp_alloc_bar function is problematic:
> >
> >  *1. The function acquires the lock at the beginning:
> > spin_lock_irqsave(&nfp->bar_lock, irqflags).
> >
> >   2. When barnum < 0 and in non-blocking mode, the code jumps to
> > the err_nobar label. However, in this non-blocking path, if
> > barnum < 0, the code releases the lock and calls nfp_wait_for_bar.
> >
> >   3. Inside nfp_wait_for_bar, find_unused_bar_and_lock is called,
> > which holds the lock upon success (indicated by the __release
> > annotation). Consequently, when nfp_wait_for_bar returns
> > successfully, the lock is still held.
> >
> >   4. But at the err_nobar label, the code always executes
> > spin_unlock_irqrestore(&nfp->bar_lock, irqflags).
> >
> >   5. The problem arises when nfp_wait_for_bar successfully finds a
> > BAR: the lock is still held, but if a subsequent reconfigure_bar
> > fails, the code will attempt to unlock it again at err_nobar,
> > leading to a double unlock.
>
> I don't understand what you're trying to say.
> If you think your analysis is correct please provide a more exact
> execution path with a code listing.

In nfp_alloc_bar(), if

- find_matching_bar() fails to find a bar
- find_unused_bar_noblock also fails to find a bar
- nonblocking == false
- nfp_wait_for_bar returns 0

In this situation, when executing nfp_bar_get(nfp, &nfp->bar[barnum]),
the code does not hold &nfp->bar_lock.
We referred to similar logic in other drivers:
https://elixir.bootlin.com/linux/v6.13/source/sound/usb/line6/driver.c#L565
It seems that a lock should be acquired here again.

> --
> pw-bot: cr
>
>