netdev - Re: [PATCH] phy: fix possible double lock calling link changed handler

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 23 Nov 2021 14:14:16 +0000
From:   "Russell King (Oracle)" <linux@...linux.org.uk>
To:     Andrew Lunn <andrew@...n.ch>
Cc:     Alessandro B Maurici <abmaurici@...il.com>, netdev@...r.kernel.org,
        Heiner Kallweit <hkallweit1@...il.com>,
        "David S. Miller" <davem@...emloft.net>
Subject: Re: [PATCH] phy: fix possible double lock calling link changed
 handler

On Tue, Nov 23, 2021 at 03:09:04PM +0100, Andrew Lunn wrote:
> On Tue, Nov 23, 2021 at 01:49:46AM -0300, Alessandro B Maurici wrote:
> > On Tue, 23 Nov 2021 05:18:14 +0100
> > Andrew Lunn <andrew@...n.ch> wrote:
> > 
> > > On Mon, Nov 22, 2021 at 11:55:48PM -0300, Alessandro B Maurici wrote:
> > > > From: Alessandro B Maurici <abmaurici@...il.com>
> > > > 
> > > > Releases the phy lock before calling phy_link_change to avoid any worker
> > > > thread lockup. Some network drivers(eg Microchip's LAN743x), make a call to
> > > > phy_ethtool_get_link_ksettings inside the link change handler  
> > > 
> > > I think we need to take a step back here and answer the question, why
> > > does it call phy_ethtool_get_link_ksettings in the link change
> > > handler. I'm not aware of any other MAC driver which does this.
> > > 
> > > 	 Andrew
> > 
> > I agree, the use in the lan743x seems related to the PTP, that driver seems
> > to be the only one using it, at least in the Linus tree. 
> > I think that driver could be patched as there are other ways to do it,
> > but my take on the problem itself is that the PHY device interface opens
> > a way to break the flow and this behavior does not seem to be documented,
> > so, instead of documenting a possible harmful interface while in the callback,
> > we should just get rid of the problem itself, and calling a callback without
> > any locks held seems to be a good alternative.
> 
> That is a really bad alternative. It is only because the lock is held
> can the MAC driver actually trust anything passed to it. The callback
> needs phydev->speed, phydev->duplex, etc, and they can change at any
> time when the lock is not held. The values can be inconsistent with
> each other, etc, unless the lock is held.
> 
> The callback has always had the lock held, so is safe. However,
> recently a few bugs have been reported and fixed for functions like
> phy_ethtool_get_link_ksettings() and phy_ethtool_set_link_ksettings()
> where they have accessed phydev members without the lock and got
> inconsistent values in race condition. These are hard race conditions
> to reproduce, but a deadlock like this is very obvious, easy to fix. I
> would also say that _ethtool_ in the function name is also a good hit
> this is intended to be used for an ethtool callback.
> 
> Lets remove the inappropriate use of phy_ethtool_get_link_ksettings()
> here.

100% agreed.

-- 
RMK's Patch system: https://www.armlinux.org.uk/developer/patches/
FTTP is here! 40Mbps down 10Mbps up. Decent connectivity at last!