netdev - RE: [net 5/5] net/mlx5: Clear LAG notifier pointer after unregister

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 9 Mar 2020 19:08:52 +0000
From:   Parav Pandit <parav@...lanox.com>
To:     Saeed Mahameed <saeedm@...lanox.com>,
        "David S. Miller" <davem@...emloft.net>
CC:     "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
        Eli Cohen <eli@...lanox.com>,
        Vlad Buslov <vladbu@...lanox.com>,
        Raed Salem <raeds@...lanox.com>,
        Saeed Mahameed <saeedm@...lanox.com>
Subject: RE: [net 5/5] net/mlx5: Clear LAG notifier pointer after unregister

Hi Eli,

> Sent: Thursday, March 5, 2020 5:18 PM
> To: David S. Miller <davem@...emloft.net>
> 
> From: Eli Cohen <eli@...lanox.com>
> 
> After returning from unregister_netdevice_notifier_dev_net(), set the
> notifier_call field to NULL so successive call to mlx5_lag_add() will function as
> expected.
> 
> Fixes: 7907f23adc18 ("net/mlx5: Implement RoCE LAG feature")
> Signed-off-by: Eli Cohen <eli@...lanox.com>
> Reviewed-by: Vlad Buslov <vladbu@...lanox.com>
> Reviewed-by: Raed Salem <raeds@...lanox.com>
> Signed-off-by: Saeed Mahameed <saeedm@...lanox.com>
> ---
>  drivers/net/ethernet/mellanox/mlx5/core/lag.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag.c
> b/drivers/net/ethernet/mellanox/mlx5/core/lag.c
> index 8e19f6ab8393..93052b07c76c 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/lag.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/lag.c
> @@ -615,8 +615,10 @@ void mlx5_lag_remove(struct mlx5_core_dev *dev)
>  			break;
> 
>  	if (i == MLX5_MAX_PORTS) {
> -		if (ldev->nb.notifier_call)
> +		if (ldev->nb.notifier_call) {
>  			unregister_netdevice_notifier_net(&init_net, &ldev-
> >nb);
> +			ldev->nb.notifier_call = NULL;
> +		}
>  		mlx5_lag_mp_cleanup(ldev);
>  		cancel_delayed_work_sync(&ldev->bond_work);
>  		mlx5_lag_dev_free(ldev);
> --
> 2.24.1

I have noticed this and applied this local change to avoid below call trace and reported it to Leon few days back in different discussion.

But I fail to justify that this was/is the right fix. To me it seems to hide another bug.
Can you please explain the flow why mlx5_lag_remove() will be called twice with i = 2 because of which null check is needed to avoid unregister_notifier second time?

RIP: 0010:__list_del_entry_valid+0x7c/0xa0
unregister_netdevice_notifier_dev_net+0x1f/0x70
mlx5_lag_remove+0x61/0xf0 [mlx5_core]
mlx5e_detach_netdev+0x24/0x50 [mlx5_core]
mlx5e_detach+0x36/0x40 [mlx5_core]
mlx5e_remove+0x48/0x60 [mlx5_core]
mlx5_remove_device+0xb0/0xc0 [mlx5_core]
mlx5_unregister_interface+0x39/0x90 [mlx5_core]
cleanup+0x5/0xdd1 [mlx5_core]