linux-kernel - Re: [PATCH net 3/8] idpf: fix possible race in idpf_vport

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <048833d9-01f5-438d-a3fa-354a008ebbd3@intel.com>
Date: Mon, 6 Oct 2025 17:07:26 -0700
From: "Tantilov, Emil S" <emil.s.tantilov@...el.com>
To: Jakub Kicinski <kuba@...nel.org>
CC: Jacob Keller <jacob.e.keller@...el.com>, Przemek Kitszel
	<przemyslaw.kitszel@...el.com>, Andrew Lunn <andrew+netdev@...n.ch>, "David
 S. Miller" <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>, "Paolo
 Abeni" <pabeni@...hat.com>, Pavan Kumar Linga <pavan.kumar.linga@...el.com>,
	Alexander Lobakin <aleksander.lobakin@...el.com>, Willem de Bruijn
	<willemb@...gle.com>, Sridhar Samudrala <sridhar.samudrala@...el.com>, "Phani
 Burra" <phani.r.burra@...el.com>, Piotr Kwapulinski
	<piotr.kwapulinski@...el.com>, Simon Horman <horms@...nel.org>, Radoslaw Tyl
	<radoslawx.tyl@...el.com>, Jedrzej Jagielski <jedrzej.jagielski@...el.com>,
	Mateusz Polchlopek <mateusz.polchlopek@...el.com>, Anton Nadezhdin
	<anton.nadezhdin@...el.com>, Konstantin Ilichev
	<konstantin.ilichev@...el.com>, Milena Olech <milena.olech@...el.com>,
	<netdev@...r.kernel.org>, <linux-kernel@...r.kernel.org>, Joshua Hay
	<joshua.a.hay@...el.com>, Aleksandr Loktionov
	<aleksandr.loktionov@...el.com>, Chittim Madhu <madhu.chittim@...el.com>,
	Samuel Salin <Samuel.salin@...el.com>
Subject: Re: [PATCH net 3/8] idpf: fix possible race in idpf_vport_stop()



On 10/6/2025 10:26 AM, Jakub Kicinski wrote:
> On Mon, 6 Oct 2025 07:49:32 -0700 Tantilov, Emil S wrote:
>>> Argh, please stop using the flag based state machines. They CANNOT
>>> replace locking. If there was proper locking in place it wouldn't
>>> have mattered when we clear the flag.
>>
>> This patch is resolving a bug in the current logic of how the flag is
>> used (not being atomic and not being cleared properly). I don't think
>> there is an existing lock in place to address this issue, though we are
>> looking to refactor the code over time to remove and/or limit how these
>> flags are used.
> 
> Can you share more details about the race? If there is no lock in place
> there's always the risk that:
> 
>    CPU 0                         CPU 1
>   idpf_vport_stop()             whatever()
>                                   if (test_bit(UP))
>                                    # sees true
>                                  # !< long IRQ arrives
>   test_and_clear(UP)
>     ...
>     all the rest
>     ...
>                                  # > long IRQ ends
>                                  proceed but UP isn't really set any more
> 

The specific case I was targeting with this patch is for when both
idpf_vport_stop() and idpf_addr_unsync(), called via set_rx_mode attempt
to delete the MAC filters. At least in my testing I have not seen a case
where the set_rx_mode callback will happen before idpf_vport_stop(). I
am assuming due to userspace reacting to the removal of the netdevs.

            rmmod-6089    [021] .....  3521.291596: idpf_remove 
<-pci_device_remove
            rmmod-6089    [021] .....  3521.292686: idpf_vport_stop 
<-idpf_vport_dealloc
  systemd-resolve-1633    [022] b..1.  3521.295320: idpf_set_rx_mode 
<-dev_mc_del
  systemd-resolve-1633    [022] b..1.  3521.295338: idpf_addr_unsync 
<-__hw_addr_sync_dev
  systemd-resolve-1633    [022] b..1.  3521.295339: idpf_del_mac_filter 
<-idpf_addr_unsync
  systemd-resolve-1633    [022] b..1.  3521.295450: idpf_set_rx_mode 
<-dev_mc_del
  systemd-resolve-1633    [022] b..1.  3521.295451: idpf_addr_unsync 
<-__hw_addr_sync_dev
  systemd-resolve-1633    [022] b..1.  3521.295451: idpf_del_mac_filter 
<-idpf_addr_unsync
            rmmod-6089    [002] .....  3521.934980: idpf_vport_stop 
<-idpf_vport_dealloc
  systemd-resolve-1633    [022] b..1.  3522.297299: idpf_set_rx_mode 
<-dev_mc_del
  systemd-resolve-1633    [022] b..1.  3522.297316: idpf_addr_unsync 
<-__hw_addr_sync_dev
  systemd-resolve-1633    [022] b..1.  3522.297317: idpf_del_mac_filter 
<-idpf_addr_unsync
   kworker/u261:2-3157    [037] ...1.  3522.297931: 
idpf_mac_filter_async_handler: Received invalid MAC filter payload (op 
536) (len 0)
            rmmod-6089    [020] .....  3522.573251: idpf_vport_stop 
<-idpf_vport_dealloc
            rmmod-6089    [002] .....  3523.229936: idpf_vport_stop 
<-idpf_vport_dealloc
  systemd-resolve-1633    [022] b..1.  3523.311435: idpf_set_rx_mode 
<-dev_mc_del
  systemd-resolve-1633    [022] b..1.  3523.311452: idpf_addr_unsync 
<-__hw_addr_sync_dev
  systemd-resolve-1633    [022] b..1.  3523.311453: idpf_del_mac_filter 
<-idpf_addr_unsync