netdev - Re: [net] net-sysfs: avoid registering new queue objects after device unregistration

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Fri, 05 Nov 2021 11:39:49 +0100
From:   Antoine Tenart <atenart@...nel.org>
To:     David Miller <davem@...emloft.net>
Cc:     kuba@...nel.org, pabeni@...hat.com, netdev@...r.kernel.org
Subject: Re: [net] net-sysfs: avoid registering new queue objects after device unregistration

Quoting Antoine Tenart (2021-10-26 16:37:33)
> Quoting David Miller (2021-10-26 16:30:57)
> > From: Antoine Tenart <atenart@...nel.org>
> > Date: Tue, 26 Oct 2021 15:38:22 +0200
> > 
> > > netdev_queue_update_kobjects can be called after device unregistration
> > > started (and device_del was called) resulting in two issues: possible
> > > registration of new queue kobjects (leading to the following trace) and
> > > providing a wrong 'old_num' number (because real_num_tx_queues is not
> > > updated in the unregistration path).
> > > 
> > >   BUG: KASAN: use-after-free in kobject_get+0x14/0x90
> > >   Read of size 1 at addr ffff88801961248c by task ethtool/755
> > > 
> > >   CPU: 0 PID: 755 Comm: ethtool Not tainted 5.15.0-rc6+ #778
> > >   Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-4.fc34 04/014
> > >   Call Trace:
> > >    dump_stack_lvl+0x57/0x72
> > >    print_address_description.constprop.0+0x1f/0x140
> > >    kasan_report.cold+0x7f/0x11b
> > >    kobject_get+0x14/0x90
> > >    kobject_add_internal+0x3d1/0x450
> > >    kobject_init_and_add+0xba/0xf0
> > >    netdev_queue_update_kobjects+0xcf/0x200
> > >    netif_set_real_num_tx_queues+0xb4/0x310
> > >    veth_set_channels+0x1c3/0x550
> > >    ethnl_set_channels+0x524/0x610
> > > 
> > > The fix for both is to only allow unregistering queue kobjects after a
> > > net device started its unregistration and to ensure we know the current
> > > Tx queue number (we update dev->real_num_tx_queues before returning).
> > > This relies on the fact that dev->real_num_tx_queues is used for
> > > 'old_num' expect when firstly allocating queues.
> > > 
> > > (Rx queues are not affected as net_rx_queue_update_kobjects can't be
> > > called after a net device started its unregistration).
> > > 
> > > Fixes: 5c56580b74e5 ("net: Adjust TX queue kobjects if number of queues changes during unregister")
> > > Signed-off-by: Antoine Tenart <atenart@...nel.org>
> > 
> > netdev_queue_update_kobjects is a confusing function name, it sounds
> > like it handles both rx and tx.  It only handles tx so
> > net_tx_queue_update_kobjects is more appropriate.
> 
> Agreed.
> 
> > Could you rename the function in this patch please?
> 
> As this is targeting stable kernels, shouldn't the rename be a separate
> patch sent to net-next instead? (And it's not the only function that
> should be renamed if we take this path, such as netdev_queue_add_kobject
> and the functions in struct kobj_type netdev_queue_ktype).

Gentle ping.