netdev - Re: [PATCH net-next] net: set initial device refcount to 1

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20210322.165526.2248035624466168840.davem@davemloft.net>
Date:   Mon, 22 Mar 2021 16:55:26 -0700 (PDT)
From:   David Miller <davem@...emloft.net>
To:     eric.dumazet@...il.com
Cc:     kuba@...nel.org, netdev@...r.kernel.org, edumazet@...gle.com,
        groeck@...gle.com
Subject: Re: [PATCH net-next] net: set initial device refcount to 1

From: Eric Dumazet <eric.dumazet@...il.com>
Date: Mon, 22 Mar 2021 11:21:45 -0700

> From: Eric Dumazet <edumazet@...gle.com>
> 
> When adding CONFIG_PCPU_DEV_REFCNT, I forgot that the
> initial net device refcount was 0.
> 
> When CONFIG_PCPU_DEV_REFCNT is not set, this means
> the first dev_hold() triggers an illegal refcount
> operation (addition on 0)
> 
> refcount_t: addition on 0; use-after-free.
> WARNING: CPU: 0 PID: 1 at lib/refcount.c:25 refcount_warn_saturate+0x128/0x1a4
> 
> Fix is to change initial (and final) refcount to be 1.
> 
> Also add a missing kerneldoc piece, as reported by
> Stephen Rothwell.
> 
> Fixes: 919067cc845f ("net: add CONFIG_PCPU_DEV_REFCNT")
> Signed-off-by: Eric Dumazet <edumazet@...gle.com>
> Reported-by: Guenter Roeck <groeck@...gle.com>

This hunk:
> @@ -10682,6 +10682,9 @@ struct net_device *alloc_netdev_mqs(int sizeof_priv, const char *name,
>  	dev->pcpu_refcnt = alloc_percpu(int);
>  	if (!dev->pcpu_refcnt)
>  		goto free_dev;
> +	dev_hold(dev);
> +#else
> +	refcount_set(&dev->dev_refcnt, 1);
>  #endif
>  
>  	if (dev_addr_init(dev))
 gets rejects in net-next.  Please respin.