linux-kernel - Re: [PATCH v3 net 1/2] net: phylink: add lock for serializing concurrent pl->phydev writes with resolver

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aLmZiwnGGSCS8Ll-@shell.armlinux.org.uk>
Date: Thu, 4 Sep 2025 14:52:11 +0100
From: "Russell King (Oracle)" <linux@...linux.org.uk>
To: Vladimir Oltean <vladimir.oltean@....com>
Cc: netdev@...r.kernel.org, Andrew Lunn <andrew@...n.ch>,
	Heiner Kallweit <hkallweit1@...il.com>,
	"David S. Miller" <davem@...emloft.net>,
	Eric Dumazet <edumazet@...gle.com>,
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH v3 net 1/2] net: phylink: add lock for serializing
 concurrent pl->phydev writes with resolver

On Thu, Sep 04, 2025 at 03:52:37PM +0300, Vladimir Oltean wrote:
> Currently phylink_resolve() protects itself against concurrent
> phylink_bringup_phy() or phylink_disconnect_phy() calls which modify
> pl->phydev by relying on pl->state_mutex.
> 
> The problem is that in phylink_resolve(), pl->state_mutex is in a lock
> inversion state with pl->phydev->lock. So pl->phydev->lock needs to be
> acquired prior to pl->state_mutex. But that requires dereferencing
> pl->phydev in the first place, and without pl->state_mutex, that is
> racy.
> 
> Hence the reason for the extra lock. Currently it is redundant, but it
> will serve a functional purpose once mutex_lock(&phy->lock) will be
> moved outside of the mutex_lock(&pl->state_mutex) section.
> 
> Another alternative considered would have been to let phylink_resolve()
> acquire the rtnl_mutex, which is also held when phylink_bringup_phy()
> and phylink_disconnect_phy() are called. But since phylink_disconnect_phy()
> runs under rtnl_lock(), it would deadlock with phylink_resolve() when
> calling flush_work(&pl->resolve). Additionally, it would have been
> undesirable because it would have unnecessarily blocked many other call
> paths as well in the entire kernel, so the smaller-scoped lock was
> preferred.
> 
> Link: https://lore.kernel.org/netdev/aLb6puGVzR29GpPx@shell.armlinux.org.uk/
> Signed-off-by: Vladimir Oltean <vladimir.oltean@....com>

Reviewed-by: Russell King (Oracle) <rmk+kernel@...linux.org.uk>

Thanks!

-- 
RMK's Patch system: https://www.armlinux.org.uk/developer/patches/
FTTP is here! 80Mbps down 10Mbps up. Decent connectivity at last!