linux-kernel - [PATCH net 3/8] idpf: fix possible race in idpf_vport

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20251001-jk-iwl-net-2025-10-01-v1-3-49fa99e86600@intel.com>
Date: Wed, 01 Oct 2025 17:14:13 -0700
From: Jacob Keller <jacob.e.keller@...el.com>
To: Przemek Kitszel <przemyslaw.kitszel@...el.com>, 
 Andrew Lunn <andrew+netdev@...n.ch>, 
 "David S. Miller" <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>, 
 Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>, 
 Emil Tantilov <emil.s.tantilov@...el.com>, 
 Pavan Kumar Linga <pavan.kumar.linga@...el.com>, 
 Alexander Lobakin <aleksander.lobakin@...el.com>, 
 Willem de Bruijn <willemb@...gle.com>, 
 Sridhar Samudrala <sridhar.samudrala@...el.com>, 
 Phani Burra <phani.r.burra@...el.com>, 
 Piotr Kwapulinski <piotr.kwapulinski@...el.com>, 
 Simon Horman <horms@...nel.org>, Radoslaw Tyl <radoslawx.tyl@...el.com>, 
 Jedrzej Jagielski <jedrzej.jagielski@...el.com>, 
 Mateusz Polchlopek <mateusz.polchlopek@...el.com>
Cc: Anton Nadezhdin <anton.nadezhdin@...el.com>, 
 Konstantin Ilichev <konstantin.ilichev@...el.com>, 
 Milena Olech <milena.olech@...el.com>, netdev@...r.kernel.org, 
 linux-kernel@...r.kernel.org, Jacob Keller <jacob.e.keller@...el.com>, 
 Joshua Hay <joshua.a.hay@...el.com>, 
 Aleksandr Loktionov <aleksandr.loktionov@...el.com>, 
 Chittim Madhu <madhu.chittim@...el.com>, 
 Samuel Salin <Samuel.salin@...el.com>
Subject: [PATCH net 3/8] idpf: fix possible race in idpf_vport_stop()

From: Emil Tantilov <emil.s.tantilov@...el.com>

Make sure to clear the IDPF_VPORT_UP bit on entry. The idpf_vport_stop()
function is void and once called, the vport teardown is guaranteed to
happen. Previously the bit was cleared at the end of the function, which
opened it up to possible races with all instances in the driver where
operations were conditional on this bit being set. For example, on rmmod
callbacks in the middle of idpf_vport_stop() end up attempting to remove
MAC address filter already removed by the function:
idpf 0000:83:00.0: Received invalid MAC filter payload (op 536) (len 0)

Fixes: 1c325aac10a8 ("idpf: configure resources for TX queues")
Reviewed-by: Joshua Hay <joshua.a.hay@...el.com>
Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@...el.com>
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@...el.com>
Reviewed-by: Chittim Madhu <madhu.chittim@...el.com>
Signed-off-by: Emil Tantilov <emil.s.tantilov@...el.com>
Tested-by: Samuel Salin <Samuel.salin@...el.com>
Reviewed-by: Simon Horman <horms@...nel.org>
---
 drivers/net/ethernet/intel/idpf/idpf_lib.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/intel/idpf/idpf_lib.c b/drivers/net/ethernet/intel/idpf/idpf_lib.c
index 89d30c395533..01ab42fa23f9 100644
--- a/drivers/net/ethernet/intel/idpf/idpf_lib.c
+++ b/drivers/net/ethernet/intel/idpf/idpf_lib.c
@@ -888,7 +888,7 @@ static void idpf_vport_stop(struct idpf_vport *vport)
 {
 	struct idpf_netdev_priv *np = netdev_priv(vport->netdev);

-	if (!test_bit(IDPF_VPORT_UP, np->state))
+	if (!test_and_clear_bit(IDPF_VPORT_UP, np->state))
 		return;

 	netif_carrier_off(vport->netdev);
@@ -911,7 +911,6 @@ static void idpf_vport_stop(struct idpf_vport *vport)
 	idpf_vport_intr_deinit(vport);
 	idpf_vport_queues_rel(vport);
 	idpf_vport_intr_rel(vport);
-	clear_bit(IDPF_VPORT_UP, np->state);
 }

 /**

-- 
2.51.0.rc1.197.g6d975e95c9d7