netdev - Re: [PATCH net] dev: Delay the free of the percpu refcount

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <959f4b3e-387d-a148-3281-aed26a6a7aa5@gmail.com>
Date:   Fri, 30 Aug 2019 11:16:18 +0200
From:   Eric Dumazet <eric.dumazet@...il.com>
To:     Subash Abhinov Kasiviswanathan <subashab@...eaurora.org>,
        eric.dumazet@...il.com, davem@...emloft.net, netdev@...r.kernel.org
Cc:     Sean Tranchetti <stranche@...eaurora.org>
Subject: Re: [PATCH net] dev: Delay the free of the percpu refcount



On 8/30/19 7:23 AM, Subash Abhinov Kasiviswanathan wrote:
> While running stress-ng on an ARM64 kernel, the following oops
> was observedi -
> 
> 44837.761523:   <6> Unable to handle kernel paging request at
>                      virtual address 0000004a88287000
> 44837.761651:   <2> pc : in_dev_finish_destroy+0x4c/0xc8
> 44837.761654:   <2> lr : in_dev_finish_destroy+0x2c/0xc8
> 44837.762393:   <2> Call trace:
> 44837.762398:   <2>  in_dev_finish_destroy+0x4c/0xc8
> 44837.762404:   <2>  in_dev_rcu_put+0x24/0x30
> 44837.762412:   <2>  rcu_nocb_kthread+0x43c/0x468
> 44837.762418:   <2>  kthread+0x118/0x128
> 44837.762424:   <2>  ret_from_fork+0x10/0x1c
> 
> Prior to this, it appeared as if some of the inet6_dev allocations
> were failing. From the memory dump, the last operation performed
> was dev_put(), however the pcpu_refcnt was NULL while the
> reg_state = NETREG_RELEASED. Effectively, the refcount memory was
> freed in free_netdev() before the last reference was dropped.
> 
> Fix this by freeing the memory after all references are dropped and
> before the dev memory itself is freed.
> 
> Fixes: 29b4433d991c ("net: percpu net_device refcount")
> Cc: Sean Tranchetti <stranche@...eaurora.org>
> Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@...eaurora.org>
> ---
>  net/core/dev.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/net/core/dev.c b/net/core/dev.c
> index 49589ed..bce40d8 100644
> --- a/net/core/dev.c
> +++ b/net/core/dev.c
> @@ -9128,6 +9128,9 @@ void netdev_freemem(struct net_device *dev)
>  {
>  	char *addr = (char *)dev - dev->padded;
>  
> +	free_percpu(dev->pcpu_refcnt);
> +	dev->pcpu_refcnt = NULL;
> +
>  	kvfree(addr);
>  }
>  
> @@ -9272,9 +9275,6 @@ void free_netdev(struct net_device *dev)
>  	list_for_each_entry_safe(p, n, &dev->napi_list, dev_list)
>  		netif_napi_del(p);
>  
> -	free_percpu(dev->pcpu_refcnt);
> -	dev->pcpu_refcnt = NULL;
> -
>  	/*  Compatibility with error handling in drivers */
>  	if (dev->reg_state == NETREG_UNINITIALIZED) {
>  		netdev_freemem(dev);
> 

This looks bogus.

Whatever layer tries to access dev refcnt after free_netdev() has been called is buggy.

I would rather trap early and fix the root cause.

Untested patch :

diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index b5d28dadf964..8080f1305417 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -3723,6 +3723,7 @@ void netdev_run_todo(void);
  */
 static inline void dev_put(struct net_device *dev)
 {
+       BUG_ON(!dev->pcpu_refcnt);
        this_cpu_dec(*dev->pcpu_refcnt);
 }
 
@@ -3734,6 +3735,7 @@ static inline void dev_put(struct net_device *dev)
  */
 static inline void dev_hold(struct net_device *dev)
 {
+       BUG_ON(!dev->pcpu_refcnt);
        this_cpu_inc(*dev->pcpu_refcnt);
 }